# An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses
## 2 An Overview of Literature on Denial-of-Service in Control Systems
### Networked State Estimation Problem  
A remote state estimation problem over a network that is subject to DoS attacks is considered in [62]. There, the researchers explore a discrete-time linear plant given by  
\[x(t+1) =Ax(t)+w(t), \tag{7}\] \[y(t) =Cx(t)+v(t), \tag{8}\]where \(x(t)\in\mathbb{R}^{n}\) and \(y(t)\in\mathbb{R}^{h}\), respectively, denote the state and output vectors; and \(w(t)\in\mathbb{R}^{n}\) and \(v(t)\in\mathbb{R}^{h}\), respectively, denote noises that are described by stochastic processes with zero-mean at each time instant \(t\). The networked state estimation framework in [62] is shown in Figure 2. In particular, a sensor at the plant side is assumed to be able to compute a local estimate \(\hat{x}_{\text{S}}(t)\in\mathbb{R}^{n}\) based on output measurements \(y(t)\). For this purpose, a Kalman filter is utilized. At certain time instants, the estimate \(\hat{x}_{\text{S}}(t)\) is sent over a communication channel to a receiving node representing a _remote estimator_. As the receiving node may not have a direct access to the state estimate \(\hat{x}_{\text{S}}(t)\) at all time instants, it keeps its own estimate \(\hat{x}(t)\) of the state. If a new state estimate from the sensor is received, the receiving node sets its estimate value to the newly obtained value (i.e., \(\hat{x}(t)=\hat{x}_{\text{S}}(t)\)). In the case where there is no transmission or the transmission fails due to DoS attacks, the receiving node cannot obtain any information. In that case, previously available state estimate is used together with the plant dynamics to obtain a predicted value by setting \(\hat{x}(t)=A\hat{x}(t-1)\). [PERSON] et al. [62] considered a finite horizon estimation problem, where \(T\in\mathbb{N}\) denotes the horizon. In this problem, a performance indicator  
\[J_{\alpha}(T)\triangleq\alpha\frac{1}{T}\sum_{t=1}^{T}\mathbb{E}[\|x(t)-\hat{ x}(t)\|^{2}]+(1-\alpha)\mathbb{E}[\|x(T)-\hat{x}(T)\|^{2}] \tag{9}\]  
with a scalar \(\alpha\in[0,1]\) is used. By setting \(\alpha=1\), \(J_{\alpha}(T)=J_{1}(T)\) represents the average estimation error variance, and by setting \(\alpha=0\), \(J_{\alpha}(T)=J_{0}(T)\) corresponds to the final estimation error variance obtained at the end of the horizon. In the problem formulation in [62], the sensor decides whether to transmit the data \(\hat{x}_{\text{S}}(t)\) or not, and similarly the attacker decides whether to attack the channel or not at each time \(t\). To identify the worst-case attack scenarios as well as the best transmission strategies, [PERSON] et al. [62] proposed game-theoretic characterizations, where the performance indicator \(J_{\alpha}(T)\) is taken into account both by the sensor and the attacker. We explain these game-theoretic characterizations in a more detailed way in Section 3.2. In those characterizations, the number of transmissions by the sensor and the number of attacks by the attacker in a given horizon \(T\) are assumed to be constrained by certain scalars that are less than \(T\). In [62], the optimal transmission and attack strategies are discussed for the case with constraints. For scenarios where the sensor attempts transmission at each time step, closed-form optimal attack strategies that maximize \(J_{1}(T)\) and \(J_{0}(T)\) are obtained in [63; 64]. The work in [63] also presents a variation of the problem of finding worst-case attack scenarios. In this variation, the attacker has additional constraints, which are proposed to explore strategies of an attacker that does not want to get detected by an intruder detection system. The state estimation problem over wireless channels with SINR-based models have been discussed in [65; 66]. Furthermore, [PERSON] et al. [67] considered a network setup with multiple wireless channels. All three works explore game-theoretic and optimization-based analysis approaches. In particular, the sensor and the attacker are considered to be the players of a game.