# An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses
## 2 An Overview of Literature on Denial-of-Service in Control Systems
### Networked Control Problem
#### 2.1.1 Discrete-Time Setting
For _multi-hop_ networked control systems (Figure 1, right), packets are attempted to be transmitted over _multi-hop networks_, and packet exchange failures happen due to drops by one or more of the malicious nodes in the network [27]. It is also important to note that the strategy used by the attackers essentially determine which packet exchanges fail. Most of the works in the literature consider the problem where the strategy of theattacker is not known a priori. Typically, certain deterministic or probabilistic models are considered to characterize how frequent the attacks happen. In Sections 3 and 4, we discuss such characterizations. In the state-feedback control problem, [PERSON] et al. [34] explored finite-horizon optimal control of a discrete-time linear plant under DoS attacks where timings of DoS can be random or arbitrary given that the total number of attacks in the horizon is bounded. [PERSON] et al. [35] considered scenarios where a bound on the number of consecutive DoS attacks is known. Furthermore, in [26; 36; 37], we investigated the effects of jamming attacks by exploring physical wireless channel models based on Signal to Interference plus Noise Ratio (SINR). In addition to the state-feedback control, the discrete-time output-feedback control problem has also been considered by taking into account the effects of DoS attacks. Specifically, [PERSON] et al. [38], [PERSON] et al. [39] and [PERSON] et al. [40] considered observer-based control ideas. In particular, [PERSON] et al. [38] and [PERSON] et al. [40] developed event-triggered controllers. The difficulty in the event-triggered output-feedback control problem is that the state information cannot be used for control purposes and for characterizing the event-triggering conditions. Observer-based quantized output-feedback control problem is investigated in [39], where a quantizer with dynamically varying ranges is utilized and sufficient convergence conditions are obtained. In addition to those results, optimal output-feedback control problem was considered by [PERSON] et al. [41] and [PERSON] et al. [42] for systems with DoS attacks and noisy measurements. Furthermore, in [43], a game-theoretical approach is taken for an output-feedback networked control problem over multiple-channels that are subject to jamming attacks. For discrete-time multi-hop networked control systems, there are several results (see, e.g., [PERSON] et al. [27], [PERSON] et al. [44], [PERSON] et al. [45], [PERSON] et al. [46]). The multi-hop network characterization in our work [27] is based on a probabilistic approach that takes into account both non-malicious and malicious failures in the network (see Section 4.2). On the other hand, [PERSON] et al. [44], [PERSON] et al. [45] and [PERSON] et al. [46] utilized a different characterization where the information flow in the network for a given scheduling and routing protocol is characterized through difference equations. For this network setup, [PERSON] et al. [44] proposed methods for designing network weights as well as controller and observer gains by taking into account potential packet losses. Moreover, [PERSON] et al. [45] and [PERSON] et al. [46] proposed methods for detecting and isolating malicious nodes that intentionally delay packets or stop forwarding them. In addition, malicious nodes that inject false data can also be handled within the framework of [45; 46].