# An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses
## 3 Deterministic and Game-Theoretical Approaches to Denial-of-Service Attack Modeling
### Game-Theoretic and Optimization-Based Approaches for Attack Modeling
#### 3.2.2 SINR-Based Models  
Recently, a few works considered Signal to Interference plus Noise Ratio (SINR) in modeling of the effect of jamming attacks to wireless communication channels (see, e.g., [66; 80]). In those works, the probability of a packet transmission error depends on the Signal to Interference plus Noise Ratio (SINR), which is the ratio of the power of transmitted signal to the sum of the attacker's interferencepower and the power of the channel noise. If the power of transmitted signal is small or interference and noise have large powers, then an error becomes highly likely. In [66], researchers investigated the estimation problem over a wireless channel with an SINR-based model. In this model the sensor chooses a power level \(p_{\mathrm{S}}(t)\in[0,\infty)\) for transmitting the estimate \(\hat{x}_{\mathrm{S}}(t)\). In addition, the jamming attacker chooses an interference power \(p_{\mathrm{A}}(t)\in[0,\infty)\) at time \(t\). The power values \(p_{\mathrm{S}}(t)\) and \(p_{\mathrm{A}}(t)\) affect the SINR given by \(\frac{p_{\mathrm{S}}(t)}{p_{\mathrm{A}}(t)+\sigma^{2}}\), where \(\sigma^{2}\) denotes the power of channel noise. The probability of a successful transmission at time \(t\) depends on SINR and is given by  
\[1-2Q\left(\sqrt{\alpha\frac{p_{\mathrm{S}}(t)}{p_{\mathrm{A}}(t)+\sigma^{2}}} \right),\]  
where \(Q(x)\triangleq\frac{1}{\sqrt{2\pi}}\int_{x}^{\infty}e^{-s^{2}/2}\mathrm{d}s\), and \(\alpha>0\) is a parameter that depends on the wireless channel properties. Notice that successful transmission probability is affected by power levels \(p_{\mathrm{S}}(t)\) and \(p_{\mathrm{A}}(t)\) used by the sensor and the attacker. In [66], optimal strategies of the sensor and the attacker are explored. In particular, first, a finite-horizon problem similar to the one in [62] is considered. The goal of the attacker is to find an optimal strategy \(p_{\mathrm{A}}(1),p_{\mathrm{A}}(2),\ldots,p_{\mathrm{A}}(T)\) that maximizes a utility function while satisfying an energy constraint  
\[\sum_{t=1}^{T}p_{\mathrm{A}}(t)=P_{\mathrm{A}},\]  
where \(P_{\mathrm{A}}>0\). In particular, the attacker's utility is chosen as \(TJ_{1}(T)\) with \(J_{\alpha}(\cdot)\) given by Equation (9). The sensor's utility function is considered to be the additive inverse of the utility of the attacker. Moreover, the energy constraint for the sensor is given by  
\[\sum_{t=1}^{T}p_{\mathrm{S}}(t)=P_{\mathrm{S}},\]  
where \(P_{\mathrm{S}}>0\). A game-theoretic approach is taken in [66] to investigate optimal sensor and attack strategies. In [64], researchers considered a similar problem and provides an analysis on the optimal attack strategies \(p_{\mathrm{A}}(1),p_{\mathrm{A}}(2),\ldots,p_{\mathrm{A}}(T)\) that yield the worst-case scenario in terms of the estimation performance. Optimal interference power levels and their effects were explored by [PERSON] et al. [80], who considered several settings of attack capabilities. In particular, [PERSON] et al. [80] considered both the case where the attacker can eavesdrop the acknowledgement messages and the case where the attacker has no knowledge of whether the attack is successful. In the case of infinite-horizon problems with an SINR-based formulation, [PERSON] et al. [66] showed that a _Q-learning_ algorithm can be used by the sensor to obtain optimal strategies for selecting transmission powers. A game with SINR-based formulation for wireless networked control systems was also considered by [PERSON] et al. [81]. The players in the game are: (1) the user who decides the power of transmissions from the controller to the plant; and (2) the jamming attacker who decides the jamming interference power. In particular, [PERSON] et al. [81] explored a _Stackelberg game_, where the user is the leader and acts first; the action of the user is then followed by that of the jamming attacker. In the problem setting in [81], the utilities of the user and the attacker depend directly on the SINR.