# A Survey on Machine-Learning Based Security Design for Cyber-Physical Systems
## 3 Taxonomy of Cyber-Physical Attacks
### Network Layer
#### 3.2.1. Denial of Service Attack  
In many control-theoretical studies, the DoS attack is defined as the prevention of delivery of control-related data, including control input signals and sensor measurements with certain network attacks [66; 67; 68; 69]. Therefore, from the perspective of control theory, a DoS attack is modeled as a signal drop in the discrete-time domain, which has the same mean as the network disruption attack in the cyber security field. To cover the impact of  
Figure 4: Cyber-physical attacks in the network layer.  
the physical dynamics (1) by an intentional packet drop from the DoS attack, in this paper, we define the DoS attack as an interruption of end-to-end packet delivery along the packet transmission path by forcing dropped packets, including communication jamming.  
The DoS attack is realized in various ways; the implementation method is dependent on communication types and network protocols [70]. In the wired network environment, a physical link cut-off is the easiest way to interrupt transmissions of control-related data. In the wireless communications environment, the jamming attack is achieved by radiating a jamming signal with a high-gain antenna into the air, and this jamming signal reduces the signal-to-noise ratio (SNR), which interferes with the receiver [71]. From man-in-the-middle (MITM) attacks [42], which steal communication authority between two nodes by exploiting vulnerabilities in network protocols, the DoS attack can be implemented by intercepting packets without forwarding.  
To express the DoS attack as viewed in the physical system layer, we rewrite physical dynamics (1) with discretization as follows:  
\[\begin{split}& x(k+1)=A_{d}x(k)+B_{d}u(k)\\ & y(k)=C_{d}x(k),\end{split} \tag{6}\]  
where \(A_{d}\in\mathbb{R}^{n\times n}\), \(B_{d}\in\mathbb{R}^{n}\), and \(C_{d}\in\mathbb{R}^{1\times n}\) are the discretized system, input, and output matrices, respectively, via a zero-order hold (ZOH). When the DoS attack is launched against the network, the control input signal cannot be updated due to the dropped packets as follows:  
\[x(k+1)=A_{d}x(k)+B_{d}u(k-1). \tag{7}\]  
Intermittent packet drops from a DoS attack impede the control performance of the physical system. Moreover, if the DoS attack is launched persistently, it destabilizes the physical system with divergence in state \(x(k)\)[66; 69].  
When the CPS is attacked at the network layer, physical system malfunctions trigger a fail-safe mode to avoid a divergence in the physical state via packet losses. The controller area network (CAN) [72], which is a wired in-vehicle network (IVN), connects massive electronic control units (ECUs) in vehicles. When a jamming signal is injected at some point on the CAN bus, most control signals on the CAN bus cannot be transmitted to ECUs, resulting in control errors in the vehicles [73]. In CBTC systems, where multiple trains and a ground station communicate through a leaky waveguide, an attacker can launch a long-range jamming attack to cause communication failures [74; 75]. Because of the repeater on the track-side, which is installed to compensate for signal attenuation with distance, jamming signals by an attacker are also amplified, and therefore the passenger capacity per unit hour is reduced because of conservative operation due to communication failures.