# An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses
## 4 Probabilistic Approaches to Models of DoS Attacks and Non-Malicious Transmission Failures
In particular, to model non-malicious transmission failures, a time-inhomogeneous Markov chain \(\{l_{\text{R}}(i)\in\{0,1\}\}_{i\in\mathbb{N}_{0}}\) can be considered with initial distributions \(\vartheta_{q}\in[0,1]\), \(q\in\{0,1\}\), and time-varying transition probabilities \(p_{q,r}\colon\mathbb{N}_{0}\to[0,1]\), \(q,r\in\{0,1\}\), satisfying  
\[\mathbb{P}[l_{\text{R}}(0)=q] =\vartheta_{q}, \tag{20}\] \[\mathbb{P}[l_{\text{R}}(i+1)=r|l_{\text{R}}(i)=q] =p_{q,r}(i),\quad i\in\mathbb{N}_{0}.\]  
The following result shows that, if the probabilities \(p_{0,1}(i)\) and \(p_{1,1}(i)\) of transition towards the failure state \(1\) are bounded by a scalar \(p_{1}\in(0,1)\), then \(l_{\text{R}}\) belongs to the failure class \(\Lambda_{\rho}\) for \(\rho\) values larger than \(p_{1}\). **Proposition 3** ([25]). : _Suppose \(p_{0,1}(i)\leq p_{1}\) and \(p_{1,1}(i)\leq p_{1}\), for \(i\in\mathbb{N}_{0}\), where \(p_{1}\in(0,1)\). Then, \(l_{\text{R}}\in\Lambda_{\rho}\) for any \(\rho\in(p_{1},1]\)._  
To model DoS attacks through the class \(\Lambda_{\rho}\), consider a network with a single DoS attacker and let \(l_{\text{A}}(i)\in\{0,1\}\) denote the possible actions of the attacker, where \(l_{\text{A}}(i)=1\) represents an attack and \(l_{\text{A}}(i)=0\) represents the absence of an attack. In certain scenarios, the DoS attacker has complete control of the network, and thus the values of \(l(i)\) can be solely decided by the actions of the attacker. In such scenarios, \(l(i)=l_{\text{A}}(i)\). If \(l_{\text{A}}(i)=1\) for all \(i\in\mathbb{N}_{0}\), then it means that all packets on the network fail to be transmitted. In the networked control problem, to achieve stabilization, some constraints on \(l_{\text{A}}(\cdot)\) were considered by [PERSON] et al. [25] through the following assumption. **Assumption 4**. : _There exist scalars \(\kappa_{\text{A}}\geq 0\) and \(\rho_{\text{A}}\in[0,1)\) such that for every \(t\in\mathbb{N}\),_  
\[\sum_{i=0}^{t-1}l_{\text{A}}(i)\leq\kappa_{\text{A}}+\rho_{\text{A}}t, \tag{21}\]  
_holds almost surely._  
Assumption 4 is similar to Assumption 1 in the sense that the inequality in Equation (21) places a restriction on the total number attacks by a certain ratio of the total number of transmission attempts. The scalar \(\rho_{\text{A}}\) in this inequality is an upper-bound on the long-run average number of times the attacker attacks the network. As pointed out in [25], in the case of jamming, this scalar can be used for characterizing the energy use of the attacker and it is also related to the _jamming rate_ mentioned in [86]. Notice that, in the context of jamming attacks, the formulation here corresponds to _reactive jamming_, where the attacker knows about the transmission times and directly attacks the network at those times. It is mentioned in [14] that, in _reactive jamming_, the attacker monitors the channel and attacks it when a transmission is detected. This approach differs from _active jamming_ attacks where the attacker's goal is to simply prevent the use of a communication channel even if the channel is not currently used. Furthermore, as mentioned in [87], there are also situations where the attacker can decide to attack based on the content of packets. Specifically, in selective jamming attacks discussed in [87], a part of the content of the packet being transmitted can become available to the attacker who can then use this information to decide whether to send jamming signals to cause failure in the delivery of this packet. A similar malicious behavior is also seen in multi-hop networks where malicious nodes can drop certain packets based on their content [88]. Notice that the characterization in Assumption 4 provides a model based on a constraint on the total number of failures due to DoS attacks and it does not describe particular attack strategies. In this sense, it differs from the probabilistic attack models (Bernoulli- and Markov-modulated cases) considered in [34; 42], where the attack strategies are described through probability distributions.