# An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses
## 4 Probabilistic Approaches to Models of DoS Attacks and Non-Malicious Transmission Failures
### SINR-Based Probabilistic Jamming Models  
The authors showed in [26] that the probabilistic approach to characterization of DoS attacks proposed in [25] is also useful for modeling jamming attacks in wireless channels. In particular, transmission failures caused by an energy-constrained jamming attacker can be described by utilizing an SINR-based model similar to those in [66; 80; 82]. Specifically, [PERSON] et al. [26] explored a networked control problem where the transmission power of the control input packets and the power of the channel noise are fixed constants. On the other hand, the interference power of the jamming attacker is allowed to depend on time and represented by the process \(\{v(i)\in[0,\infty)\}_{i\in\mathbb{N}_{0}}\). The likelihood of a transmission failure at a given time \(t_{i}\) depends on the interference power \(v(i)\) of the attacker. If \(v(i)\) is large, then a transmission failure becomes more likely. Our work [26] utilizes a Borel-measurable, nondecreasing function \(p\colon[0,\infty)\to[0,1]\) to describe the probability of failures. This function is used in the characterization of the transmission failure indicator \(l(i)\) as  
\[l(i)\triangleq\mathds{1}[r(i)\leq p(v(i))], \tag{23}\]  
where \(r(i)\) is a random variable that is uniformly distributed in \([0,1]\) for each \(i\in\mathbb{N}_{0}\). It is important to observe that Equation (23) implies  
\[\mathbb{P}[l(i)=1|v(i)=\vartheta]=p(\vartheta), \tag{24}\]  
that is, the conditional failure probability given that the jamming attacker sets the interference power to \(\vartheta\in[0,\infty)\) is represented by \(p(\vartheta)\). It is assumed that \(r(0),r(1),\ldots\) in Equation (23) are mutually independent so that failures occurring at different times are _conditionally independent_ given the jamming interference powers at those times. In other words, for every \(t_{1}<t_{2}<\cdots<t_{k},k\in\mathbb{N}\),  
\[\mathbb{P}[l(t_{1})=1,\cdots,l(t_{k})=1|v(t_{1})=\vartheta_{1}, \cdots,v(t_{k})=\vartheta_{k}]=\prod_{i=1}^{k}\mathbb{P}[l(t_{i})=1|v(t_{i})= \vartheta_{i}].\]  
In this setup, \(l(\cdot)\) becomes a Bernoulli process with transmission failure probability \(\mathbb{P}[l(t)=1]=p(\vartheta)\), if \(v(\cdot)\) is constant with \(v(i)=\vartheta\), \(i\in\mathbb{N}_{0}\). Note that the function \(p(\cdot)\) depends on SINR. For instance, if we consider the wireless channel setup in [66] (see Section 3.2.2), we set \(p(v)=2Q\Big{(}\sqrt{\alpha\frac{\zeta}{v+\sigma^{2}}}\Big{)}\) where \(Q(x)\triangleq\frac{1}{\sqrt{2\pi}}\int_{x}^{\infty}e^{-\frac{\sigma^{2}}{2} }\mathrm{d}s\), \(\alpha>0\), and \(\zeta\in(0,\infty)\) and \(\sigma^{2}\in(0,1)\) are, respectively, the transmission power and the power of the channel noise in the SINR \(\frac{\zeta}{v+\sigma^{2}}\). The energy constraints of the attacker are captured in [26] by means of introducing the following assumption, which places a bound on the average jamming interference power. Figure 5: Ranges of \(\rho\) values for the class \(\Lambda_{\rho}\). The ranges are different, when different transmission issues are considered in the network. **Assumption 7**. : _There exist scalars \(\kappa_{\mathfrak{j}}\geq 0\) and \(\overline{\
u}_{\mathfrak{j}}\geq 0\) such that_  
\[\mathbb{P}\big{[}\sum_{i=0}^{t-1}v(i)\leq\kappa_{\mathfrak{j}}+\overline{\
u}_{ \mathfrak{j}}t\big{]}=1,\quad t\in\mathbb{N}. \tag{25}\]  
In this assumption, \(\overline{\
u}_{\mathfrak{j}}\geq 0\) characterizes the long-run upper-bound on the average interference power that can be utilized by the attacker. Moreover, \(\kappa_{\mathfrak{j}}\geq 0\) determines the attacker's initial capabilities. More specifically, \(\limsup_{t\to\infty}\frac{1}{t}\sum_{i=0}^{t-1}v(i)\leq\overline{\
u}_{ \mathfrak{j}}\), almost surely. Furthermore, \(\frac{1}{t}\sum_{i=0}^{t-1}v(i)\leq\frac{\kappa_{\mathfrak{j}}}{t}+\overline{ \
u}_{\mathfrak{j}}\) for the first \(t\) transmission attempts.