## 4 Implementation of Optimal Attack Strategy
### Real-Time Improvement by BP Neural Network  
In the case of unknown parameters, the previous subsection gives the expression (13) for the attacker to obtain the estimated value, \(\hat{\theta}_{k}\), based on the data \(s^{0}_{l,k}\) output from the binary observer, and the attacker can estimate the parameters while accepting the data and utilize Algorithm 1 to implement the optimal data tampering attack. Although the PSO algorithm converges every time the global optimal position is calculated, it is still difficult to meet the real-time requirements of the data tampering attack, so this subsection introduces the BP neural network to improve the real-time performance.  
Taking different \(\theta\) as neural network inputs, the optimal attack strategy, \(\Omega^{*}\), under different \(\theta\) is obtained by PSO, the data of mapping the relationship from \(\theta\) to \(\Omega^{*}\) are used as a dataset, and the model is obtained after BP neural network training, and the trained model is denoted as \(\varpi(\theta)\), which is used for the prediction of optimal attack strategies in online attacks.  
The first step is the selection of the dataset. The BP network is a data-driven machine learning algorithm, and training requires a large amount of sufficiently motivated data, so we need to uniformly sample the input, \(\theta\), in the sample space, and then utilize the PSO algorithm to obtain the optimal output of different inputs, that is, the optimal data tampering attack strategy. The input vector, \(\theta\), in the training set needs to be sampled uniformly within the upper and lower bounds, so the input data are obtained as follows:  
Assume an \(n\)-dimensional vector \(\theta=(a_{1},a_{2},\ldots,a_{n})\), where each dimension, \(a_{i}\), takes values ranging between \(a_{i}\) and \(\beta_{i}\). Here \(\alpha_{i}\) is the lower bound and \(\beta_{i}\) is the upper bound.  
1. Initialization, for the \(i\)-th dimension, \(a_{i}\), the range of values is \([\alpha_{i},\beta_{i}]\).
2. The value of \(a_{i}\) can be expressed as follows: \[a_{i}=\alpha_{i}+(k_{i}-1)\Delta_{i},\] where \(k_{i}\) is an integer indicating the index of the sampling point in the \(i\)-th dimension, and \(\Delta_{i}\) is the interval between each step, that is, the step length of the uniform sampling, which is computed by the formula \(\Delta_{i}=\frac{\beta_{i}-a_{i}}{N_{i}-1}\), where \(N_{i}\) is the total number of samples in the \(i\)-th dimension.
3. Eventually, after sampling each dimension uniformly in the \(n\)-dimensional space, all possible combinations of values of the vector \(\theta\) are the combinations in each dimension \(\theta=(a_{1},a_{2},\ldots,a_{n})\), where each \(a_{i}\) follows the uniform sampling rule described above.  
After obtaining the dataset, the structure of the BP network is designed as a two-layer hidden layer. The BP neural network used to generate the dataset has the following architecture:  
* **Input:** the input to the network is a 3-dimensional vector, which is the parameter estimation of \(\hat{\theta}_{k}\) at the moment \(k\).
* **Output:** the output of the network is a 6-dimensional vector, which is the optimal data tampering attack strategy, \(\Omega^{*}\).  
* **Input layer:*
* three neurons, corresponding to the 3-dimensional input vector.
* **Hidden layer 1:*
* 20 neurons, activation function is tansig.
* **Hidden layer 2:*
* 20 neurons, activation function is tansig.
* **Output layer:*
* six neurons, activation function is purelin.
* **Other parameters:*
* epoch: 1000; optimizer: Levenberg-Marquardt.  
The training process of the BP network model is shown in Figure 2.