Security of Cyber-Physical Systems (CPS) has gained increasing attention in recent years. Most existing works mainly investigate the system performance given some attacking patterns. In this technical note, we investigate how an attacker should schedule its Denial-of-Service (DoS) attacks to degrade the system performance. Specifically, we consider the scenario where a sensor sends its data to a remote estimator through a wireless channel, while an energy-constrained attacker decides whether to jam the channel at each sampling time. We construct optimal attack schedules to maximize the expected average estimation error at the remote estimator. We also provide the optimal attack schedules when a special intrusion detection system (IDS) at the estimator is given. We further discuss the optimal attack schedules when the sensor has energy constraint. Numerical examples are presented to demonstrate the effectiveness of the proposed optimal attack schedules.

Recently, many literature works have considered the security issues of wireless networked control system (WNCS). However, few works studied how the attacker should optimize its attack schedule in order to maximize the effect on the system performance due to the insufficiency of energy at the attacker side. This paper fills this gap from the aspect of control system performance. We consider the optimal jamming attack that maximizes the Linear Quadratic Gaussian (LQG) control cost function under energy constraint. After analyzing the properties of the cost function under an arbitrary attack schedule, we derive the optimal jamming attack schedule and the corresponding cost function. System stability under this optimal attack schedule is also considered. We further investigate the optimal attack schedule in a WNCS with multiple subsystems. Different examples are provided to demonstrate the effectiveness of the proposed optimal denial-of-service attack schedule.

This paper considers a remote state estimation problem, where a sensor measures the state of a linear discrete-time process and has computational capability to implement a local Kalman filter based on its own measurements. The sensor sends its local estimates to a remote estimator over a communication channel that is exposed to a Denial-of-Service (DoS) attacker. The DoS attacker, subject to limited energy budget, intentionally jams the communication channel by emitting interference noises with the purpose of deteriorating estimation performance. In order to maximize attack effect, following the existing answer to “when to attack the communication channel”, in this paper we manage to solve the problem of “how much power the attacker should use to jam the channel in each time”. For the static attack energy allocation problem, when the system matrix is normal, we derive a sufficient condition for when the maximum number of jamming operations should be used. The associated jamming power is explicitly provided. For a general system case, we propose an attack power allocation algorithm and show the computational complexity of the proposed algorithm is not worse than O(T ), where T is the length of the time horizon considered. When the attack can receive the real-time ACK information, we formulate a dynamic attack energy allocation problem, and transform it to a Markov Decision Process to find the optimal solution.

In microgrids, distributed load sharing plays an important role in maintaining the supply-demand balance of power. Because False Data Injection (FDI) is one of the crucial threats faced by future microgrids, the study of the impact of FDI on distributed load sharing is of both theoretical merit and practical value. In this paper, we consider the distributed load sharing problem of the microgrids operating in autonomous mode under FDI. Each bus is assumed to be equipped with an agent. Under a well developed distributed load sharing protocol based on multiagent systems, we first construct an FDI attack model, where the attacker is capable of injecting false data into the bus agents. Then, a utilization level is introduced for coordinating generators and its variation is evaluated in the presence of FDI attacks with given injection strategies. The stable region of the microgrid is defined and conditions are given to determine stability. Finally, the theoretical results are validated on the Canadian urban distribution system.

This paper addresses the secure control problem of cyber-physical systems (CPSs) under Denial-of-Service (DoS) attack with power constraint. The purpose of the attacker is to degenerate the control performance of CPSs at the reduced cost of attack power. Unlike the existing works developed under the assumption of time-invariant channel states, the sensor-to-estimator communication channel under consideration is a standard block fading communication channel. By taking the angle of the DoS attacker, an optimization problem is formulated to deal with both the linear quadratic control cost of the CPS and the expenditure of attack power. Then, the formulated problem is transformed into a Markov decision problem. As it is difficult to provide an analytical expression of optimal attack power, the objective function is approximated to derive an analytical expression of the suboptimal attack power. Next the attack strategies for two specific communication schemes, namely, the capacity achieving coding scheme and the forward error correction scheme, are studied. Finally, the validity of the proposed attack strategy is demonstrated by an illustrative example.