## 5 Numerical Simulation  
In this paper, we consider the system based on (1)  
\[\left\{ \begin{array}{l}y_{l,k}=\phi_{l}^{T}\theta+d_{l,k},\\ s_{l,k}=I_{\{y_{l,k}\leq C_{l}\}},k=1,\ldots,N,\;\;l=1,\ldots,m,\end{array} \right. \tag{18}\]  
where the sample length \(N=5000\); system parameters \(\theta=[3,2,-1]^{T}\); the threshold of binary sensor \([C_{1},C_{2},C_{3}]=[7,-2,3]\); the attack energy constraint is \(\bar{p}=\bar{q}=0.8\), the total energy constraint \(\epsilon=2\); and the noise satisfies Assumption 1, and is a Gaussian distribution with mean \(0\) and standard deviation \(10\). The initial number of populations for PSO is set to \(50\), the spatial dimension is \(6\), the maximum number of iterations is \(100\), the inertia weight is set to \(0.8\), and the self-learning factor and population learning factor are both \(0.3\). Figure 2: Flow of BP neural network algorithm. The BP neural network used contains two hidden layers, the number of nodes in the input and output layers is related to the dimension of the input and output data, the intermediate hidden layers are set to 20 neuron nodes, and the data in the training set are used in the PSO optimization algorithm to generate 1000 groups of \(\theta\) and their corresponding \(\Omega^{*}\). The training and testing sets are divided into 7:3. While \(\theta\) is given, we compared Algorithm 1 with GA. Both have their populations set to 50, the maximum number of iterations is 100, and the fitness function to be optimized is the average entropy in (5). As shown in Figure 3, it can be seen that the algorithm converges to the optimal value in advance under Algorithm 1, and the average entropy of the global optimal value converged to is better compared with the GA. Figure 4 plots the average entropy under the optimal attack strategy based on Algorithm 1, and the other two groups of attack strategies are \(\{0.1,0.3,0.2,0.6,0.5,0.2\}\) and \(\{0.1,0.2,0.3,0.2,0.4,0.4\}\) in comparison. The two groups are in offline form and cannot be updated in real time according to the change of system parameters, and it can be seen that the average entropy of Algorithm 1 is the smallest, which means that the attack is the most effective. In addition, in Figure 5, the estimation error calculated by 2-norm between the true and estimated values of the system parameter, \(\theta\), under different attack strategies are shown, at which time the attack based on Algorithm 1 is better than the other two groups of attack strategies. Figure 4: Average entropy of PSO algorithm against other strategies. Figure 3: The fitness value of Algorithm 1 and GA. (**a**) Algorithm 1. (**b**) GA. However, it is difficult for Algorithm 1 to meet the attacker's requirements for real-time performance in actual attacks, and thus the BP network is needed to optimize the real-time performance of online attacks. In this simulation, 1000 sets of mapping data from different \(\theta\) to the optimal attack strategy solution set, \(\Omega^{*}\), are used as the training set, and the network model is obtained after iterative training of the BP network. In the process of online attack, the attacker utilizes the trained model and takes the real-time value of parameter estimation, \(\hat{\theta}_{k}\), as the network input to obtain the output value, \(\Omega^{*}_{k}\), and uses it to carry out the attack strategy for the current attack. In the simulation experiments, the average entropy of the improved online attacks based on the BP network are smaller than the other two sets of strategies, as shown in Figure 6, and, under the same conditions, Figure 7 represents the comparison of the estimation errors between the true values of the system parameters and the estimation values of the proposed network model in this paper, which are larger than the estimation errors of other two sets of data.