Optimal innovation-based attacks against remote state estimation with side information and historical data

This paper aims to investigate the security problem of nonlinear cyber-physical systems (CPSs), which poses a challenge to handle compared with linear CPSs. A series of optimization problems for nonlinear CPSs under injection attack are constructed, which are based on a general model of the nonlinear systems with repetitive operation characteristics and a novel introduction of the key technical lemma. These optimization results are more general than the existing injection attack results and the requirements for attackers to obtain system information are relaxed. Also, the form of switching applied to the attack strategy possesses several advantages, including high stealthiness, lower cost, and more flexibility. Therefore, the new optimal injection attack strategies are expected to be more widespread and provide a basis for the design of defense strategies. The key to acquiring the designed optimal attack strategies is to adopt the linear input/output (I/O) data model for these systems via introducing an estimation term of the improved projection estimation method into the linear model. Finally, a networked GLUON-6L3 manipulator example validates the effectiveness of the proposed methods. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Note to Practitioners</i> —The main purpose of this paper is to study the cyber security of nonlinear cyber-physical systems from the perspective of attackers, which can help defenders fully understand the behavior of attackers. Most of the existing attack strategies aimed at linear systems or have a priori knowledge of the attacked systems. However, there are great limitations and difficulties in practical application. In this paper, the new attack strategies are proposed by combining system identification, iterative learning and control theory, which relaxes the requirement of the attacker’s ability. In detail, the attacker only needs to obtain the control input and output data of the attacked system and design the attack strategy according to it. Among them, the first-in, first-out queue storage method is applied to remove the requirements for the storage capability of the attacker. In practical applications, the attacker does not need to store the I/O data continuously, but only store the initial value and the data of two successive iterations. The mathematical analytic forms of two optimal attack strategies are given, and then their effectiveness are verified on a welding work of a networked six-axis manipulator. In the future, we will investigate the design of attack strategies for nonlinear systems with heterogeneous dynamics and multiple delays.

Consequence Analysis of Innovation-based Integrity Attacks with Side Information on Remote State Estimation

This paper considers a Denial-of-Service (DoS) attack scheduling problem. Specifically, a sensor employs the wireless link to send the data packet to the remote estimator at each time step, while an energy-constrained attacker launches DoS attacks against the remote state estimation, and designs an optimal attack strategy to maximize damage to the remote estimation quality. The packet will drop if the channel is jammed. In most of the existing works on DoS attacks, it is assumed that the wireless channel is perfect, i.e., the packet dropout never occurs in the absence of attack. However, this is far from the practical situation. To encompass the lossy nature of wireless networks, we study the scenario of lossy networks in which the packet may drop even without attack, and construct the optimal attack strategy that maximizes the average expected estimation error at the remote estimator over lossy networks. Numerical simulations are provided to demonstrate the effectiveness of the theoretical results.

We investigate the impact of Byzantine attacks in distributed detection under binary hypothesis testing. It is assumed that a fraction of the transmitted sensor measurements are compromised by the injected data from a Byzantine attacker, whose purpose is to confuse the decision maker at the fusion center. From the perspective of a Byzantine attacker, under the injection energy constraint, an optimization problem is formulated to maximize the asymptotic missed detection error probability, which is based on the Kullback-Leibler divergence. The properties of the optimal attack strategy are analyzed by convex optimization and parametric optimization methods. Based on the derived theoretic results, a coordinate descent algorithm is proposed to search the optimal attack solution. Simulation examples are provided to illustrate the effectiveness of the obtained attack strategy.

Optimal energy constrained deception attacks in cyber–physical systems with multiple channels: A fusion attack approach

Remote state estimation in which wireless sensors transmit data to a remote device for estimating the state of a physical process is an important issue in cyber-physical systems (CPS). Since the wireless channel is open-access, adversaries can easily launch denial-of-service (DoS) attacks and cause significant estimation performance deterioration, regardless of the use of cryptographic techniques for sensor data security. Most existing studies on DoS attacks in CPS often assume perfect channels. In this paper, we study the impact and strategies of DoS attacks in a more practical scenario where the wireless channel suffer from stochastic background traffics. We propose a probabilistic attack scheme in which the attacker senses the channel state and only executes DoS when the sensing result indicates an idle channel. Specifically, with the proposed probabilistic attack scheme, the attacker launches DoS with a certain probability once the channel is sensed idle. We theoretically analyze the stability of the estimation process and investigate the problem of optimal attack strategy under attackers energy constraint.

In recent years, the problem of cyber–physical systems’ remote state estimations under eavesdropping attacks have been a source of concern. Aiming at the existence of eavesdroppers in multi-system CPSs, the optimal attack energy allocation problem based on a SINR (signal-to-noise ratio) remote state estimation is studied. Assume that there are N sensors, and these sensors use a shared wireless communication channel to send their state measurements to the remote estimator. Due to the limited power, eavesdroppers can only attack M channels out of N channels at most. Our goal is to use the Markov decision processes (MDP) method to maximize the eavesdropper’s state estimation error, so as to determine the eavesdropper’s optimal attack allocation. We propose a backward induction algorithm which uses MDP to obtain the optimal attack energy allocation strategy. Compared with the traditional induction algorithm, this algorithm has lower computational cost. Finally, the numerical simulation results verify the correctness of the theoretical analysis.

In the rapidly evolving landscape of Cyber-Physical Systems (CPS), understanding potential vulnerabilities through the design of sophisticated attack strategies is crucial for developing robust defense mechanisms. This paper focuses on formulating innovative False Data Injection (FDI) attack strategies that leverage current and historical data under relaxed stealthiness constraints, measured by the Kullback-Leibler Divergence (KLD). By exploring the trade-offs between attack performance and detection risk, we propose two types of attack policies that not only enhance the effectiveness of the attacks but also offer practical implementation benefits. The optimal attack parameters are derived analytically, enabling efficient offline pre-calculation and real-time deployment. Finally, simulation studies on a satellite system validate the superiority of our strategies over existing methods, demonstrating the ability to maximize disruption while maintaining stealthiness. This research not only deepens our understanding of CPS vulnerabilities but also lays the groundwork for more resilient defense strategies by anticipating and countering sophisticated attacks.

Cyber-security is of the fundamental importance for cyber-physical systems (CPSs), since CPSs are vulnerable to cyber attack. In order to make the defensive measures better, one needs to understand the behavior from the view of an attacker. In this paper, the problem of false data injection attack on remote state estimation with resource constraints is studied in two cases, where the first case is that the attacker adds a Gaussian noise to the innovation, while the other is that the attacker employs a Gaussian noise to replace the innovation. In addition, the attacker is assumed to has a resource constraint, i.e., he/she cannot attack all the sensors, at the same time should decide which sensors to attack. By using the matrix theory, the optimal attack strategy problem, which aims to maximize the trace of the remote estimation error covariance, is converted into a convex optimization problem that can be solved. Thus, an optimal attack strategy is given to illustrate which sensors should be attacked. An example is given to show the effectiveness of the theoretical results.

We consider remote state estimation of cyber physical systems under signal-to-interference-plus-noise ratio-based denial-of-service attacks. A sensor sends its local estimate to a remote estimator through a wireless network that may suffer interference from an attacker who can chose its attack action from multiple energy levels. The goal of the attacker is to design the optimal attack strategy to degrade the control performance of cyber-physical systems while minimize his energy consumption. Based on this, we formulate a optimization problem and translate it to a Markov decision problem (MDP). To solve the associated optimality (Bellman) equations, a reverse recursive iterative algorithm is applied to obtain the optimal solution. Numerical examples and simulations are provided to demonstrate the effectiveness and feasibility of the proposed method.

A guessing wiretapper's performance on a Shannon cipher system is analyzed for a source with memory. Close relationships between guessing functions and length functions are first established. Subsequently, asymptotically optimal encryption and attack strategies are identified and their performances analyzed for sources with memory. The performance metrics are exponents of guessing moments and probability of large deviations. The metrics are then characterized for unifilar sources. Universal asymptotically optimal encryption and attack strategies are also identified for unifilar sources. Guessing in the increasing order of Lempel-Ziv coding lengths is proposed for finite-state sources, and shown to be asymptotically optimal. Finally, competitive optimality properties of guessing in the increasing order of description lengths and Lempel-Ziv coding lengths are demonstrated.

This paper investigates the problem of remote state estimation in cyber-physical systems subject to stochastic stealthy attacks. Unlike existing studies that assume persistent intrusion, the attack success is modeled as a stochastic process, thereby providing a more realistic characterization of adversarial capabilities. A comprehensive analysis is conducted from both short-term and long-term perspectives. In the short-term analysis, the evolution of the estimation error covariance is examined, and optimal attack strategies are derived under explicit stealthiness constraints, which limit the detection probability of the attacker. In the long-term analysis, the conditions under which the expected estimation error covariance diverges or converges are explored as a function of the attack success rate and strategy. Rigorous necessary, sufficient, and equivalent conditions for error covariance divergence are established. Moreover, the convergence behavior of the estimation process is characterized under various attack designs, revealing critical thresholds and trade-offs between attack frequency and intensity. Simulation results are provided to validate the theoretical findings and to illustrate the quantitative impact of attack parameters on estimation performance degradation.

Optimal DoS attack schedules on remote state estimation under multi-sensor round-robin protocol

A kind of attack strategy based on a probabilistic cloning machine is proposed in this letter. The security of BB84 and the six-state quantum key distribution protocols under this attack is studied by theoretic analyses and corroborated by simulations. It is concluded that the quantum key distribution protocols still have an asymptotic perfect security even if the eavesdropper adopts the proposed attack strategy.

A dynamic encryption–decryption scheme for replay attack detection in cyber–physical systems