PaperlayerView exact revision on arXiv

Source-linked AI summary

Iterative Behavioral Identification for Covert Misappropriation Attacks

Victor Mattos, Amit Bhaya, Daniel Sadoc Menasche, Alan O. de Sá

arXiv:2610.32662v1eess.SYcs.CRcs.SY

TL;DR

Prior attacks require plant or controller models, while passive closed-loop data may lack persistent excitation and unconstrained active probing can violate stealth. A three-phase pipeline uses low-amplitude probing, predictor-based masking during rank-increasing identification, and a final Hankel matrix for DeePC-style covert attack synthesis. Across 23 Phase-2 iterations, normalized projection error decreased monotonically to zero as Hankel rank rose from 1 to 24; masked Phase-3 tracking never triggered the alarm.

  • Problem

    Prior attacks require plant or controller models, while passive closed-loop data may lack persistent excitation and unconstrained active probing can violate stealth.

    Source: B. Limitations of Existing Work · p. 2

  • Method

    A three-phase pipeline uses low-amplitude probing, predictor-based masking during rank-increasing identification, and a final Hankel matrix for DeePC-style covert attack synthesis.

    Source: §I · p. 1

  • Results

    Across 23 Phase-2 iterations, normalized projection error decreased monotonically to zero as Hankel rank rose from 1 to 24; masked Phase-3 tracking never triggered the alarm.

    Source: B. Results · p. 6

  • Takeaways & Limitations

    The identified subspaces expand strictly, and the projection error of a desired trajectory decreases monotonically, almost surely strictly at each rank increase.

    Source: A. Monotone Decrease of Projection Error · p. 5, §XI · p. 6

    Existing attacks require plant or controller models unavailable to a MITM adversary, and passive observation does not yield PE data.

    Source: B. Limitations of Existing Work · p. 2

Abstract

from arXiv · show

We present a data-driven, three-phase framework for covert misappropriation attacks on closed-loop networked control systems. A man-in-the-middle (MITM) adversary, with access only to intercepted input-output data, incrementally identifies the plant's behavioral subspace while maintaining stealth under an infinity-norm intrusion-detection system (IDS). Phase 1 collects an initial rank-deficient Hankel matrix using a low-amplitude probing signal that satisfies an analytical stealth bound. Phase 2 adapts online rank-increasing experiment design to the closed-loop setting, using causal predictor-based masking to limit IDS residuals while the Hankel rank grows from 1 to the full behavioral rank n + mL in exactly n + mL - 1 steps. We show that the identified subspaces are strictly nested and that the projection error of any desired trajectory decreases monotonically, strictly so almost surely at each rank increase. Phase 3 employs the final Hankel matrix in a DeePC-style optimization to synthesize a covert attack that tracks an arbitrary reference while respecting the IDS constraint. Simulations on a DC motor with PI control demonstrate full-rank identification and stealthy tracking. Stealth is guaranteed analytically in Phases 1 and 3 and is numerically supported in Phase 2. The method is model-free and assumes noise-free LTI dynamics.

I. INTRODUCTION

The paper addresses covert MITM attacks that steer networked plants while avoiding IDS alarms, despite the attacker lacking plant and controller models. It proposes a three-phase pipeline that incrementally learns closed-loop behavior from intercepted data and uses it for covert trajectory synthesis.

I. INTRODUCTION

  • The attacker starts without plant or controller model knowledge and seeks to learn closed-loop input–output behavior from intercepted data before steering the plant along a malicious reference undetected.Source: §I · p. 1
  • Informative persistently exciting data are needed for a useful predictor, but large injections can violate the IDS threshold, motivating a structured incremental design.Source: §I · p. 1
  • The three-phase pipeline uses low-amplitude probing, predictor-based masking during rank-increasing identification, and a final Hankel matrix in a DeePC optimization to synthesize an IDS-constrained attack.Stealth is guaranteed analytically in Phases 1 and 3, while Phase 2 stealth is supported numerically.Source: §I · p. 1

A. Networked Control Systems under MITM Attacks

  • Covert MITM attacks steer a plant toward an unintended trajectory while keeping monitored quantities within IDS limits, making them difficult to detect and potentially severe.The attacker intercepts and alters controller–actuator and sensor–controller signals in real time.Source: §I · p. 1, A. Networked Control Systems under… · p. 2

B. Limitations of Existing Work

The paper identifies gaps in model-based covert attacks and passive identification, then proposes a model-free pipeline that integrates covert probing, behavioral identification, and attack synthesis. Its analysis assumes noise-free LTI dynamics.

B. Limitations of Existing Work

  • Prior covert-attack designs assume knowledge of plant or controller dynamics, while passive closed-loop data under steady-state regulation are typically not persistently exciting.Active probing without stealth constraints is easily detected.Source: B. Limitations of Existing Work · p. 2
  • The paper identifies a missing unified framework combining model-free behavioral prediction, stealth-constrained active identification, and closed-loop attack synthesis.Recent efforts address isolated aspects, but none provide the unified framework described here.Source: B. Limitations of Existing Work · p. 2

C. Contributions

  • The proposed pipeline requires no a priori model knowledge and integrates probing, identification, and behavioral attack synthesis using intercepted closed-loop data.Source: C. Contributions · p. 2
  • The analysis assumes noise-free LTI dynamics, and robustness to noise is left for future work.Source: C. Contributions · p. 2

A. Plant, Controller, and Closed Loop

  • The plant and controller are LTI, their parameters and orders are unknown to the attacker, and nominal operation remains near a constant setpoint.The assumed plant is controllable and observable, and the controller stabilizes the closed loop.Source: A. Plant, Controller, and Closed Loop · p. 2

B. Peak Gain of the Actuator-to-Output Map

The paper bounds actuator injections using an estimated peak gain and the IDS margin. Its behavioral representation treats recorded input–output windows as plant trajectories, while active injection is needed to explore the behavior beyond passive data.

B. Peak Gain of the Actuator-to-Output Map

  • An actuator injection bounded by (εids−εss)/Ĝ∞ keeps the unmasked output deviation within the IDS margin.The nominal output may already use εss of the threshold budget; masking can further reduce the realized residual.Source: B. Peak Gain of the Actuator-to-Output… · p. 2

C. Behavioral Representation and Hankel Matrices

IV. THREAT MODEL AND IDS

The threat model places a MITM adversary between plant and controller, able to alter both channels while initially lacking model knowledge. The IDS monitors the controller-facing output signal against an infinity-norm threshold.

A. MITM Channels

  • The MITM adversary intercepts and alters actuator and sensor channels, injecting at the actuator and masking the sensor signal received by the controller and IDS.Source: A. MITM Channels · p. 3

B. Attacker Knowledge

  • The attacker knows the IDS threshold, steady-state estimates, a peak-gain estimate, closed-loop stability and LTI status, and the full intercept history, but not plant or controller parameters, orders, or transfer functions.Source: B. Attacker Knowledge · p. 3

C. IDS Model

  • The IDS triggers when the monitored signal differs from its steady-state estimate by more than εids; an attack is stealthy if it never triggers.The monitored signal is the one received by both controller and IDS, and actuator injections are unobserved.Source: C. IDS Model · p. 3, A. MITM Channels · p. 3

V. PHASE 1: INITIAL COVERT PROBING

Phase 1 uses low-amplitude probing to seed a rank-one Hankel matrix, making further identification necessary. The closed-loop rank-increasing design reaches full behavioral rank in the same sample complexity as the open-loop design.

A. Injection Design

B. Initial Hankel Matrix and the Role of T1 = L

  • With T1 = L, the initial Hankel matrix has rank 1, so its predictor spans only one direction and Phase 2 is necessary.A rank-1 predictor can reproduce only scalar multiples of the observed window, yielding large projection error for a generic target.Source: B. Initial Hankel Matrix and the Role… · p. 3

A. Closed-Loop Sample Complexity

  • The attacker’s unconstrained additive actuator input lets it implement the open-loop rank-increasing design in closed loop.The design reaches full behavioral rank after T2 = n + mL − 1 rank-increasing steps.Source: A. Closed-Loop Sample Complexity · p. 3
  • The total experiment length is T⋆ = n + (m + 1)L − 1 samples, matching the open-loop design and saving mn samples versus the offline Fundamental Lemma requirement.The total combines T1 = L Phase-1 samples and T2 Phase-2 steps.Source: A. Closed-Loop Sample Complexity · p. 3

B. Stealth-Friendly Rank-Increasing Injection

Phase 2 selects actuator injections to make each new Hankel column independent of the previous columns. A closed-loop non-degeneracy condition supports this rank increase, while masked residuals—not the Phase-1 unmasked amplitude bound—govern stealth.

B. Stealth-Friendly Rank-Increasing Injection

  • A new Hankel column is redundant when a nonzero left-kernel vector annihilates its weighted contribution across every previously observed window.The closed-loop non-degeneracy assumption supplies such a nontrivial vector while the Hankel rank is below full rank.Source: B. Stealth-Friendly Rank-Increasing… · p. 4
  • An injection satisfying the rank-increasing condition makes the new Hankel column linearly independent, increasing rank by exactly one.The condition is evaluated after observing the nominal input and output; the quantities used are known to the attacker.Source: B. Stealth-Friendly Rank-Increasing… · p. 4
  • The injection violates condition (14), increasing rank by Proposition 2; its Phase-2 amplitude is not constrained by the Phase-1 unmasked budget, because stealth constrains the masked residual instead.Sensor masking drives the residual toward zero as H(k) improves.Source: B. Stealth-Friendly Rank-Increasing… · p. 4

C. Sensor Masking During Phase 2

During Phase 2, the attacker predicts the nominal output before measurement and masks the induced deviation. This can reduce the IDS residual, but early rank deficiency means stealth is not analytically guaranteed.

C. Sensor Masking During Phase 2

  • The attacker predicts the output for the nominal input from the current behavioral predictor and masks the measured deviation so the reported output is approximately nominal.The prediction uses the preceding Tini-step window and is formed before the output is observed.Source: C. Sensor Masking During Phase 2 · p. 4
  • Early rank deficiency can leave prediction error large, so the masked residual is not guaranteed to meet the stealth bound; stealth is numerically supported rather than analytically guaranteed.As rank grows, prediction error tends to decrease and masking becomes more effective.Source: C. Sensor Masking During Phase 2 · p. 4
  • As the behavioral predictor improves, a given injection leaves a smaller masked residual, allowing a larger injection amplitude within the stealth budget.Masking quality and admissible injection size reinforce each other as Phase 2 proceeds.Source: C. Sensor Masking During Phase 2 · p. 4

D. Nested Behavioral Subspaces and Projection Error

Each rank increase adds a direction to the identified behavioral subspace, expanding the trajectories the attacker can represent. Stopping can target full rank or a desired projection-error tolerance, with different implications for exact representation and masking.

D. Nested Behavioral Subspaces and Projection Error

E. Dual Interpretation and Stopping Criteria

  • Phases 1–2 can be viewed both as refining the attacker’s representation and as expanding the trajectories reproducible with zero prediction error.The stopping rule trades these interpretations against stealth cost.Source: E. Dual Interpretation and Stopping… · p. 4
  • Stopping at full behavioral rank makes every desired trajectory in B_L exactly representable, and the plant order is recovered as a by-product.Full rank is reached after T2 = n + mL − 1 steps.Source: E. Dual Interpretation and Stopping… · p. 4
  • A projection-error tolerance ε permits stopping once the desired trajectory’s error is at most ε, either executing its projection or accepting that residual for masking.Executing the projection is exact but may deviate slightly from the intended trajectory; using the exact target leaves a residual for the mask to absorb.Source: E. Dual Interpretation and Stopping… · pp. 4–5

VII. THEORETICAL ANALYSIS

For almost every executable desired trajectory, each rank-increasing step strictly reduces projection error; after Phase 2 reaches full rank, the trajectory is exactly representable. The excitation seed persists and later rank increases may partly draw on the closed loop’s own response.

A. Monotone Decrease of Projection Error

  • Under the absolute-continuity assumption on executable targets, every strict subspace increase almost surely strictly decreases the projection error.The target distribution is on B_L, the space of plant trajectories, and avoids every fixed lower-dimensional subspace.Source: A. Monotone Decrease of Projection Error · p. 5
  • After K rank-increasing steps to full rank, d0(w⋆) > d1(w⋆) > ··· > dK(w⋆) = 0 almost surely, so the target is exactly representable.Each step adds one direction; strict decrease can fail only on a measure-zero subset of B_L.Source: A. Monotone Decrease of Projection Error · p. 5
  • The first informative column persists in later Hankel matrices, while closed-loop feedback may let later rank increases draw partly on the system response and reduce injection budget.Source: A. Monotone Decrease of Projection Error · p. 5

VIII. PHASE 3: BEHAVIORAL COVERT MISAPPROPRIATION

The learned Hankel matrix predicts future plant behavior from recent input-output history, then supports a receding-horizon optimization for covert reference tracking. The DC-motor simulation uses a rank-24 predictor after 23 Phase 2 steps.

A. Behavioral Predictor Construction

  • Given recent input-output history, behavioral consistency selects Hankel coefficients g and uses the resulting columns to predict future inputs and outputs.Under TC2, the coefficients are found by least squares.Source: A. Behavioral Predictor Construction · p. 5

B. DeePC-Style Attack Optimization

  • Phase 3 solves a convex receding-horizon QP for a malicious output reference and preferred input profile, constraining the masked output residual to the IDS threshold.The masking predictor uses the realized attack input; the first optimal input is applied before updating history and resolving.Source: B. DeePC-Style Attack Optimization · p. 5

A. Setup and Parameters

  • In the DC-motor setup, the predictor reaches rank 24 after 23 Phase 2 steps, following 22 low-amplitude Phase 1 samples.The simulation uses a second-order motor with PI control, Tini = 2, and prediction horizon N = 20.Source: A. Setup and Parameters · p. 5

B. Results

The DC-motor simulation reaches full behavioral rank and tracks a sinusoidal reference while the masked residual remains below the IDS threshold. The discussion limits the guarantees to noise-free LTI dynamics and identifies computational and detector-model boundaries.

B. Results

  • At rank 24 after 23 Phase 2 iterations, projection error falls to zero, and Phase 3 tracks a sinusoid ±0.5 about the nominal output while masked residuals stay below the IDS threshold.The unmasked residual exceeds the threshold at every reference peak, whereas the masked residual does not trigger the alarm.Source: B. Results · pp. 5–6, Figure 1 · p. 6

X. DISCUSSION AND LIMITATIONS

  • Noise-free LTI dynamics are assumed; with noise, strict nesting is only approximate, projection error may floor above zero, and stealth becomes probabilistic.The infinity-norm IDS is analytically tractable but weaker than CUSUM or χ2 tests; adapting masking to statistical detectors remains open.Source: §X · p. 6
  • Phase 2 costs O((qL)^2) per step and Phase 3 scales with NK and N, so real-time use may require warm-starting; attack regularity may itself be detectable.Periodic Hankel updates are suggested as an extension to slowly time-varying plants.Source: §X · p. 6

XI. CONCLUSION

  • The framework combines rank-increasing identification and DeePC-style synthesis under MITM access, with strictly nested subspaces and almost-surely decreasing projection error.Full rank is reached in T⋆ = n + (m + 1)L − 1 samples; noise robustness and richer IDS models remain open directions.Source: §XI · p. 6

Related papers

Loading 2610.32662v1…