Optimal DoS attack strategy against remote state estimation over lossy networks

This paper aims to investigate the security problem of nonlinear cyber-physical systems (CPSs), which poses a challenge to handle compared with linear CPSs. A series of optimization problems for nonlinear CPSs under injection attack are constructed, which are based on a general model of the nonlinear systems with repetitive operation characteristics and a novel introduction of the key technical lemma. These optimization results are more general than the existing injection attack results and the requirements for attackers to obtain system information are relaxed. Also, the form of switching applied to the attack strategy possesses several advantages, including high stealthiness, lower cost, and more flexibility. Therefore, the new optimal injection attack strategies are expected to be more widespread and provide a basis for the design of defense strategies. The key to acquiring the designed optimal attack strategies is to adopt the linear input/output (I/O) data model for these systems via introducing an estimation term of the improved projection estimation method into the linear model. Finally, a networked GLUON-6L3 manipulator example validates the effectiveness of the proposed methods. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —The main purpose of this paper is to study the cyber security of nonlinear cyber-physical systems from the perspective of attackers, which can help defenders fully understand the behavior of attackers. Most of the existing attack strategies aimed at linear systems or have a priori knowledge of the attacked systems. However, there are great limitations and difficulties in practical application. In this paper, the new attack strategies are proposed by combining system identification, iterative learning and control theory, which relaxes the requirement of the attacker’s ability. In detail, the attacker only needs to obtain the control input and output data of the attacked system and design the attack strategy according to it. Among them, the first-in, first-out queue storage method is applied to remove the requirements for the storage capability of the attacker. In practical applications, the attacker does not need to store the I/O data continuously, but only store the initial value and the data of two successive iterations. The mathematical analytic forms of two optimal attack strategies are given, and then their effectiveness are verified on a welding work of a networked six-axis manipulator. In the future, we will investigate the design of attack strategies for nonlinear systems with heterogeneous dynamics and multiple delays.

Remote state estimation in which wireless sensors transmit data to a remote device for estimating the state of a physical process is an important issue in cyber-physical systems (CPS). Since the wireless channel is open-access, adversaries can easily launch denial-of-service (DoS) attacks and cause significant estimation performance deterioration, regardless of the use of cryptographic techniques for sensor data security. Most existing studies on DoS attacks in CPS often assume perfect channels. In this paper, we study the impact and strategies of DoS attacks in a more practical scenario where the wireless channel suffer from stochastic background traffics. We propose a probabilistic attack scheme in which the attacker senses the channel state and only executes DoS when the sensing result indicates an idle channel. Specifically, with the proposed probabilistic attack scheme, the attacker launches DoS with a certain probability once the channel is sensed idle. We theoretically analyze the stability of the estimation process and investigate the problem of optimal attack strategy under attackers energy constraint.

The adaptive control of bilateral teleoperation system under denial of service (DoS) attacks is studied in this letter. The model of bilateral teleoperation system under DoS attacks is presented. The adaptive controllers are designed to deal with the influence of data missing caused by packet dropouts and DoS attacks. Two Bernoulli distributed variables are introduced to describe the system dynamic for the case that both packet dropouts and DoS attacks are involved in the communication channels. The globally asymptotically stability criterion is proposed by using Lyapunov functional methods, which implies the dynamics of the Master and the Slave are globally asymptotically synchronized. A numerical example of two degree of freedom bilateral teleoperation system is provided to show the effectiveness of obtained results.

Cyber-security is of the fundamental importance for cyber-physical systems (CPSs), since CPSs are vulnerable to cyber attack. In order to make the defensive measures better, one needs to understand the behavior from the view of an attacker. In this paper, the problem of false data injection attack on remote state estimation with resource constraints is studied in two cases, where the first case is that the attacker adds a Gaussian noise to the innovation, while the other is that the attacker employs a Gaussian noise to replace the innovation. In addition, the attacker is assumed to has a resource constraint, i.e., he/she cannot attack all the sensors, at the same time should decide which sensors to attack. By using the matrix theory, the optimal attack strategy problem, which aims to maximize the trace of the remote estimation error covariance, is converted into a convex optimization problem that can be solved. Thus, an optimal attack strategy is given to illustrate which sensors should be attacked. An example is given to show the effectiveness of the theoretical results.

Optimal attack strategy of complex networks based on tabu search

The problem of key generation over wireless fading channels is investigated. First, a joint source-channel approach that combines existing source and channel models for key agreement over wireless fading channels is developed. It is shown that, in general, to fully exploit the resources provided by time-varying channel gains, one needs to combine both the channel model, in which Alice sends a key to Bob over a wireless channel, and the source model, in which Alice and Bob generate a key by exploiting the correlated observations obtained from the wireless fading channel. Asymptotic analyses suggest that in the long coherence time regime, the channel model is asymptotically optimal. On the other hand, in the high power regime, the source model is asymptotically optimal. Second, the framework is extended to the scenario with an active attacker. Assuming that the goal of the attacker is to minimize the key rate that can be generated using the proposed protocol and the attacker will employ such an attack strategy, the attacker's optimal attack strategy is identified and the key rate under this attack model is characterized.

A guessing wiretapper's performance on a Shannon cipher system is analyzed for a source with memory. Close relationships between guessing functions and length functions are first established. Subsequently, asymptotically optimal encryption and attack strategies are identified and their performances analyzed for sources with memory. The performance metrics are exponents of guessing moments and probability of large deviations. The metrics are then characterized for unifilar sources. Universal asymptotically optimal encryption and attack strategies are also identified for unifilar sources. Guessing in the increasing order of Lempel-Ziv coding lengths is proposed for finite-state sources, and shown to be asymptotically optimal. Finally, competitive optimality properties of guessing in the increasing order of description lengths and Lempel-Ziv coding lengths are demonstrated.

This paper investigates the problem of remote state estimation in cyber-physical systems subject to stochastic stealthy attacks. Unlike existing studies that assume persistent intrusion, the attack success is modeled as a stochastic process, thereby providing a more realistic characterization of adversarial capabilities. A comprehensive analysis is conducted from both short-term and long-term perspectives. In the short-term analysis, the evolution of the estimation error covariance is examined, and optimal attack strategies are derived under explicit stealthiness constraints, which limit the detection probability of the attacker. In the long-term analysis, the conditions under which the expected estimation error covariance diverges or converges are explored as a function of the attack success rate and strategy. Rigorous necessary, sufficient, and equivalent conditions for error covariance divergence are established. Moreover, the convergence behavior of the estimation process is characterized under various attack designs, revealing critical thresholds and trade-offs between attack frequency and intensity. Simulation results are provided to validate the theoretical findings and to illustrate the quantitative impact of attack parameters on estimation performance degradation.

This work investigates the attack strategy design problem of the false data injection attack against the cyber-physical system. Distinct from the relevant results which utilise the current intercepted data or additionally consider side information, a more universal attack model is proposed which combines historical data and side information with the current intercepted data to synergistically deteriorate the system estimation performance. In order to quantify the impact resulting from the proposed attack strategy, the optimisation objective is characterised by deriving the error covariance matrix under the attacks, which becomes more intricate since the proposed attack model introduces more decision variables and coupled terms. Take the stealthiness which is characterised by Kullback-Leibler divergence as the constraints, the problem investigated in this work is equivalently transformed into the constrained multi-variable non-convex optimisation problems, which are not able to be solved directly by the methods in the relevant results. By utilising the Lagrange multiplier method, the structural characteristic of the optimal mean and the optimal covariance which only related to the Lagrange multiplier are derived, such that the optimal distribution of the modified innovation is able to be obtained by a simple search procedure. Following that, the design of the optimal attack strategy is completed by using semi-definite programming to derive the optimal attack matrices. Finally, the simulation examples are given such that the validity of the results is verified.

This chapter focuses on the very serious problem of denial of service (DoS) attacks against computer systems and networks. DoS attacks are attacks designed to disrupt, overwhelm, and/or damage computing resources and data. These attacks are aimed not against confidentiality of data or integrity of systems and data, but rather against availability of systems and data. Attackers launch DoS attacks for a wide variety of reasons. The probability of success is high, due in large part to the fact that the Internet itself has not been designed for security. The cost of DoS attacks is often high—several well‐known attacks have reportedly cost organizations billions of dollars. Many types of DoS attacks have surfaced so far, including resource starvation attacks, buffer overflow attacks, and packet fragmentation attacks. Distributed denial of service (DDoS) attacks, attacks in which programs planted in multiple systems cooperate, represent an even higher level of threat. Preventing DoS attacks is difficult in the first place due to a plethora of reasons; limiting the potential for damage and disruption is often the most cost‐effective strategy. Hot sites, cold sites, use of uninterruptible power supplies (UPSs) and Redundant Array of Independent Drives (RAID) solutions, and other measures can limit the damage from DoS attacks. Using properly configured and maintained firewalls is one of the best single prevention measures. Additionally, using packet filters on systems, keeping up with patches, limiting services that run on these systems, and using other measures go a long way in helping prevent susceptibility to DoS attacks.

This article investigates an attack-detection-based event-triggered transmission scheme (AD-ETS) for cyber-physical systems (CPSs) subject to malicious denial of service (DoS) attacks. Due to the fact that DoS attacks can prevent transmissions without any specific rules, we characterize the effects caused by such attacks as arbitrarily bounded successive triggered-packet dropouts. On the one hand, a novel DoS attack detection strategy based on a transmission acknowledgement (ACK) scheme is developed to govern the switching of the event-triggered thresholds in real time. Compared with the existing resilient event-triggered transmission and switching-like event-triggered schemes, the proposed AD-ETS will make full use of historical ACK signals to distinguish DoS attacks from probabilistic packet dropouts and make a decision on switching event-triggered transmission strategy. Thus, both timely transmission and communication efficiency can be accomplished by using AD-ETS. On the other hand, the maximum allowable event-triggered parameter, which can guarantee the stability of the nonlinear CPSs, is derived by exploiting the input delay approach. Based on the derived maximum allowable event-triggered parameter, the relation between the secure event-triggered parameter and the number of successive DoS-incurred packet dropouts is pursued which supplies the basis of secure event design for event-triggered transmission under DoS attacks. Compared with the existing works, the secure event-triggered transmission strategy by considering successive DoS-incurred packet dropouts just depends on the event-triggered-threshold rather than nonlinear dynamics. At last, simulations on stabilization of vehicle longitudinal dynamics are conducted to verify the effectiveness of the proposed AD-ETS.

The parallel distributed detection is studied for mobile wireless sensor networks (MWSNs) in the presence of Byzantine attacks in entirely unknown environment or complicated environment from the perspective of the information theory, where we pay most of our attention toward design, analysis, and evaluation of the attack strategy. In particular, the multihop relay network and the harsh wireless communication condition, e.g., the dynamic and entirely unknown channel, are taken into consideration in our configuration. Second, the conditions that the optimal attacking strategy should satisfy is analyzed and developed under different attacking scenarios. Third, the minimum attacking power is developed for the Byzantines to blind the fusion center (FC). Furthermore, the optimal attacking strategies are developed when no prior information of the system is known for the Byzantines. Finally, the traditional four typical attack strategies are evaluated, and we find that the fraction of Byzantines is the only factor that affects the reliable data fusion when the network size and the attacking strategy are fixed. The extensive simulation is conducted to verify our design, analysis, and evaluation of the attack strategy.

We consider remote state estimation of cyber physical systems under signal-to-interference-plus-noise ratio-based denial-of-service attacks. A sensor sends its local estimate to a remote estimator through a wireless network that may suffer interference from an attacker who can chose its attack action from multiple energy levels. The goal of the attacker is to design the optimal attack strategy to degrade the control performance of cyber-physical systems while minimize his energy consumption. Based on this, we formulate a optimization problem and translate it to a Markov decision problem (MDP). To solve the associated optimality (Bellman) equations, a reverse recursive iterative algorithm is applied to obtain the optimal solution. Numerical examples and simulations are provided to demonstrate the effectiveness and feasibility of the proposed method.

Resilient control of networked control systems with stochastic denial of service attacks

Cyberspace is vulnerable to continuous malicious attacks. Traceability of network attacks is an effective defense means to curb and counter network attacks. In this paper, the evolutionary game model is used to analyze the network attack and defense behavior. On the basis of the quantification of attack and defense benefits, the replication dynamic learning mechanism is used to describe the change process of the selection probability of attack and defense strategies, and finally the evolutionary stability strategies and their solution curves of both sides are obtained. On this basis, the attack behavior is analyzed, and the probability curve of attack strategy and the optimal attack strategy are obtained, so as to realize the effective traceability of attack behavior.