Covert Attacks in Cyber-Physical Control Systems

I. INTRODUCTION

• NCS integrate controllers and physical plants through forward and feedback network streams, enabling improved operational and management capabilities and reduced costs.The forward stream connects the controller to plant actuators; the feedback stream carries plant sensor outputs to the controller.Source: §I · p. 1
• Network integration also exposes closed-loop control systems to cyber-domain threats, motivating studies of vulnerabilities and security solutions.Source: §I · p. 1
• The proposed service-degradation attack injects false data to subtly change physical behavior, with interventions dimensioned to be difficult for people to perceive.The stated aim is to reduce plant efficiency or cause damage over the mid or long term without an uncontrolled intervention that could disclose the attack or cause immediate breakdown.Source: §I · p. 1
• The System Identification attack uses the Backtracking Search Optimization algorithm to gather the plant transfer function G(z) and controller function C(z), which can inform the degradation attack.Without knowledge of system dynamics, attack consequences may be unpredictable.Source: §I · p. 2
• The paper proposes a taxonomy that analyzes cyber-physical attack covertness simultaneously in physical and cybernetic aspects.Source: §I · p. 2
• The stated purpose is to demonstrate the accuracy achievable when service-degradation attacks are supported by System Identification attacks and encourage countermeasure research.The paper explicitly says its objective is not to facilitate such attacks.Source: §I · p. 2

II. RELATED WORKS

• Earlier approaches use arbitrary network flooding or randomly generated false signals without plant and controller models, leaving physical effects and covertness uncertain.Excess traffic may reduce covertness, while interventions on unknown models can produce extreme or unpredictable physical behavior.Source: §II · p. 2
• Prior MitM covert attacks require plant-model knowledge and false-data injection in both streams, but assess covertness at controller signals rather than physical perceptibility to a human observer.Source: §II · p. 2
• Prior covert-attack work requiring NCS models does not explain how attackers obtain that knowledge; this paper's joint approach demonstrates obtaining system data and using it to plan a covert attack.Source: §II · p. 2

III. TAXONOMY

• The paper introduces a taxonomy of possible attacks on cyber-physical control systems, including a new approach to analyzing their covertness.Source: §III · p. 2

A. Classification of the Attacks

• Attacks may target NCS devices or communications, and the taxonomy treats the physical process's work as the service being attacked or protected.Source: A. Classification of the Attacks · p. 3
• Denial-of-Service attacks interrupt the physical process, while Service Degradation attacks reduce service efficiency or may reduce the plant's mean time between failures over the mid or long term.Source: A. Classification of the Attacks · p. 3
• Controlled attacks are precisely planned to achieve a desired behavior and require accurate plant and controller models; arbitrary attacks do not use prior model knowledge.Service-Degradation attacks aim to keep the process running with reduced efficiency, whereas uncontrolled planning can lead to interruption.Source: A. Classification of the Attacks · p. 3
• Cyber-Physical Intelligence attacks gather information about system operation or design to plan covert and controlled attacks, and do not themselves impact the NCS.The proposed System Identification attack analyzes network signals to obtain the controller's control function and the plant's transfer function.Source: A. Classification of the Attacks · pp. 3–4

B. Cybernetic vs. Physical Covertness

• Covertness concerns whether an attack is perceived or detected and must be analyzed in both the cyber and physical domains.Source: B. Cybernetic vs. Physical Covertness · p. 4
• Cybernetically covert attacks have a low probability of detection by systems monitoring NCS software, communications, data, or plant dynamics.Source: B. Cybernetic vs. Physical Covertness · p. 4
• Physically covert attacks cause effects that are difficult for a human observer to notice or identify, or that may be attributed to another cause.They slightly modify system behavior while still physically affecting the plant.Source: B. Cybernetic vs. Physical Covertness · p. 4

IV. THE SYSTEM IDENTIFICATION ATTACK

• The attack estimates coefficients of the plant transfer function G(z) and controller control function C(z) using BSA to minimize a fitness function.Both functions are treated as linear time-invariant systems.Source: §IV · p. 4
• BSA uses information from past generations to search for solutions, with population size P and movement-amplitude parameter η adjusted empirically.η is adjusted to support both exploration and exploitation.Source: §IV · p. 4
• Captured input i(k) and output o(k) are obtained by eavesdropping during monitoring period T, with the last received sample held when samples are lost.The generic transfer function Q(z) uses numerator and denominator coefficients as model parameters to be identified.Source: §IV · p. 4
• BSA iteratively adjusts an estimated model using captured input, then compares its output with the captured output to compute each individual's fitness.The model coefficients form an individual's coordinates in the BSA population.Source: §IV · p. 4
• When no samples are lost, fitness reaches zero when the estimated model's coefficients match those of the actual device.Source: §IV · p. 4
• The paper likens this identification attack to known-plaintext cryptanalysis, with input and output corresponding to plaintext and ciphertext.The transfer-function form corresponds to the encryption algorithm, and its actual coefficients to the secret key.Source: §IV · p. 4

V. THE COVERT ATTACK FOR SERVICE DEGRADATION

• The attack is classified as SD-Controlled Data Injection and inserts false data into the control loop to reduce process efficiency or the plant's MTBF.The attacker also desires physical covertness.Source: §V · pp. 4–5
• Overshoot during a plant's transient response or a constant steady-state error can degrade service; low-proportion or brief effects may be difficult for a human observer to notice.Overshoots can stress and possibly damage physical systems; steady-state error may reduce efficiency or occasionally stress and damage the system over the medium or long term.Source: §V · p. 5
• A MitM injects controlled false data through M(z), designed from plant and controller models obtained by the System Identification attack.Although the figure places the MitM in the forward stream, interference in the feedback stream is also possible.Source: §V · p. 5

VI. RESULTS

• The simulations combine the System Identification attack with physically covert SD-Controlled attacks.Source: §VI · p. 5
• The results section proceeds from the attacked-system model to System Identification results and then to covert attack simulations.Source: §VI · p. 5
• The simulated SD-Controlled Data Injection attacks are planned using data gathered by the System Identification attack.Source: §VI · p. 5

A. The Model of the Attacked System

• The modeled NCS uses a PI controller to control a DC motor's rotational speed, with the controller and motor transfer functions matching those in.Source: A. The Model of the Attacked System · p. 5
• The simulations use a 50-sample/s rate and a unitary step function as the set point.Source: A. The Model of the Attacked System · p. 5
• Network delay is not included in the simulations.Source: A. The Model of the Attacked System · p. 5

B. Results of the System Identification Attack

• The simulations assume a known DC-motor PI-controller equation structure, capture both streams for T = 2s, and estimate plant and controller coefficients separately across four sample-loss rates.There are 100 simulations per loss rate; the BSA runs for 800 iterations for the four plant coefficients and 600 for the two controller coefficients.Source: B. Results of the System… · p. 5
• The coefficient distributions are leptokurtic; skewness is high for plant coefficients and moderate for controller coefficients, with no clear trend as sample loss rises.The results do not show a general increasing or decreasing pattern in skewness or kurtosis with increasing sample loss.Source: B. Results of the System… · p. 6
• Plant estimates for g3 and g4 perform better than those for g1 and g2, which the authors attribute to output sensitivity to pole rather than zero variations.The authors state that the fitness function grows faster for errors in g3 and g4, leading the BSA population to converge more accurately in those dimensions.Source: B. Results of the System… · p. 6
• Controller coefficient estimates are more accurate than plant estimates at all sample-loss rates, in part because the controller search has two dimensions rather than four.The controller means are closer to their actual values and have smaller confidence intervals.Source: B. Results of the System… · p. 6
• As sample loss grows, coefficient-error magnitudes tend to increase, although their modes remain close to zero at every tested loss rate.The study measures plant and controller coefficient errors as |Eg| = |Gr−Ge| and |Ec| = |Cr−Ce|, respectively.Source: B. Results of the System… · p. 6

C. Results of the Service Degradation Attacks

• For the overshoot attack, responses based on identified models remained similar to the real-model response at both 0% and 20% sample loss; all responses converge to 1 rad/s.The attacker adjusted Ko using the average estimated coefficients and used root-locus analysis to target a 50% overshoot.Source: C. Results of the Service Degradation… · p. 6, Figure 6 · p. 8
• The overshoot attack uses M(z) = Ko, with Ko adjusted to make the system underdamped and its peak rotational speed 50% above steady-state speed.Ko is adjusted using the average coefficients estimated by the System Identification attack.Source: C. Results of the Service Degradation… · p. 6
• For the steady-state-error attack, the attacker adjusts KEss from identification data; M(z)'s pole permits stationary error and its zero shapes the root locus for a stable −10% target.The passage describes the design rationale; the reported attack outcomes are summarized in the first point.Source: C. Results of the Service Degradation… · p. 6
• At 20% sample loss, the attacks produced a 45.94% overshoot and a −9.8% stationary error, close to the respective 50% and −10% targets.The table reports results for the different sample-loss rates used during the System Identification attack.Source: C. Results of the Service Degradation… · p. 6, Table III · p. 8

• With 20% sample loss, the attacker attained an overshoot of 45.94% and a stationary error of −9.8%, near desired 50% and −10%, respectively.Source: §VII · p. 8
• The BSA-based System Identification attack gathered data used to plan service-degradation interventions, and its effectiveness was statistically analyzed across different sample-loss rates.Source: §VII · p. 8
• The joint operation achieved high accuracy, and both physically covert interventions avoided unwanted behaviors that would be physically perceivable.Source: §VII · p. 8
• The authors encourage research on techniques to avoid or complicate physically covert attacks planned with System Identification data.Source: §VII · p. 8