# An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses
## 1 Introduction
The work in [16] illustrates that off-the-shelf hardware with wireless capabilities can be used for generating jamming attacks on wireless networks that use the popular IEEE 802.11 protocol. Jamming attacks can target both the physical layer and the medium access control (MAC) layer of the protocol. In the case of physical-layer attacks, the jamming attacker is not even required to follow the wireless protocol. By simply emitting strong interference signals, the jamming attacker can cause a decrease in the Signal to Interference plus Noise Ratio (SINR), which in turn prevents the receiver to detect transmitted packets [16]. In the case of MAC-layer attacks, both the packet sender and the jamming attacker operate on the same channel; the jamming attacker's goal is to cause packet collisions [16]. Under jamming attacks, packets transmitted to the receiver may get corrupted and fail cyclic redundancy checks (CRC) used in the protocol. Note that, in wireless networks, jamming attacks and packet-dropping attacks by malicious nodes can also coexist. Recently, DoS attacks have been investigated in the context of feedback control, state estimation, and multi-agent consensus problems. To tackle these problems, researchers have proposed several approaches for characterizing the occurrences of attacks. In particular, some of the works in the literature present models that take into account the energy constraints that an attacker may have. In another line of research, optimal attack strategies are investigated through game-theoretic frameworks and worst-case attack scenarios are studied. In this paper, we give an overview of both lines of research. In addition, we also discuss probabilistic modeling approaches that attempt to capture the effects of both malicious DoS attacks and non-malicious reasons of transmission failures. Such approaches are needed, as attacks may not be the only source of transmission failures in networks. Typically, networks may face non-malicious link errors, channel noise, and congestions caused by genuine network users [17; 18]. In this paper, we discuss the utility of different modeling approaches in analyzing system security in control, estimation, and consensus problems. Furthermore, we present recent developments in the design of attack-resilient control and communication protocols. We note that there are several review articles that discuss various aspects of denial-of-service attacks from the viewpoint of information technologies. In particular, denial-of-service attacks in sensor networks are investigated in [19]. A discussion of defense mechanisms against denial-of-service attacks is provided in [20]. Distributed denial-of-service attacks and potential approaches of mitigating their effects are explored in [21; 22]. Additionally, an overview of a set of control-theoretical methods as well as techniques from information technologies to mitigate jamming attacks is presented in [23], and, furthermore, a survey of articles concerned with DoS and false data injection attacks in control systems for the smart grid is provided in [24]. Differently from previous works, we present an overview of DoS attacks in networked control systems with a special emphasis on probabilistic modeling and analysis approaches. We organize the rest of our paper into five sections. In Section 2, we introduce control problems subject to DoS attacks and provide an overview of the literature that explore those problems. In Section 3, we discuss several deterministic, game-theoretical and optimization-based attack-modeling approaches. Moreover, in Section 4, we discuss recent developments in probabilistic approaches to modeling of networks that face denial-of-service attacks and also non-malicious issues. We then present a set of recently developed attack-resilient control and communication techniques in Section 5. Finally, we conclude the paper in Section 6. We use fairly standard notation in the paper. Specifically, nonnegative and positive integers are, respectively, denoted by \(\mathbb{N}_{0}\) and \(\mathbb{N}\).