# An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses
## 2 An Overview of Literature on Denial-of-Service in Control Systems
### Networked Control Problem
#### 2.1.1 Discrete-Time Setting  
We first look at the networked control problem of a discrete-time linear plant described by  
\[x(t+1) =Ax(t)+Bu(t),\quad x(0)=x_{0},\quad t\in\mathbb{N}_{0}, \tag{1}\] \[y(t) =Cx(t), \tag{2}\]  
where \(x(t)\in\mathbb{R}^{n}\), \(u(t)\in\mathbb{R}^{m}\), and \(y(t)\in\mathbb{R}^{h}\), respectively, denote the state, the input, and the output vectors of the plant. Moreover, \(A\in\mathbb{R}^{n\times n}\), \(B\in\mathbb{R}^{n\times m}\), and \(C\in\mathbb{R}^{h\times n}\), respectively, denote the state, the input, and the output matrices representing the dynamics. In the state-feedback networked control problem, sensors located at the plant side measure the state \(x(\cdot)\) and transmit it to the controller, which then computes a control input and transmits it back to the plant. In the output-feedback setting, the sensors measure and transmit the output \(y(\cdot)\). State-feedback networked control problem under DoS attacks is discussed in our previous works [25; 26; 27]. In those works, the system without control is considered to be unstable (i.e., \(A\) has eigenvalues that are outside the unit circle of the complex plane); moreover, the goal is to achieve stabilization of the zero solution \(x(t)\equiv 0\) by means of designing suitable control and communication rules. It is also assumed there that the network does not induce delay in transmissions, but packets may fail to be delivered due to attacks. In [28], we further generalized the setting so that delays can also be taken into account. In the control frameworks in [25; 26; 27; 28], the input \(u(t)\) that is applied to the plant is set to \(0\) when there is a failure in the transmission of the state measurement or the control input data. This is one of the most common approaches in the networked control literature that deals with transmission failures (e.g., [PERSON] et al. [29], [PERSON] et al. [30], [PERSON] et al. [31], [PERSON] and [PERSON] [32]). In the setup in [25; 26; 27; 28], acknowledgement messages are not needed, since a packet exchange failure is known to the plant by the absence of an incoming control input. This in turn allows UDP-like communication protocols discussed in [33] to be used for the practical implementation of the networked operation. In [26; 27], we assumed that packet exchanges take place at every time step. On the other hand, in [25], we developed event-based communication (transmission) rules. In the event-based approach, packet exchanges are attempted between the plant and the controller at times \(t_{0},t_{1},t_{2},\ldots\in\mathbb{N}_{0}\) (with \(t_{i}<t_{i+1}\)). These times are decided based on certain event-triggering conditions. The triggering conditions proposed in [25] guarantee that the state stays within certain level sets in between consecutive transmission attempt times, and packet exchange attempts are triggered only before the state is predicted to leave a predefined level set. A more detailed explanation to this event-triggering setup is given in Section 5.1.1. In the event-based setting in [25], the control input \(u(t)\) applied to the plant is given by  
\[u(t)\triangleq(1-l(i))\,Kx(\tau_{i}),\quad t\in\{t_{i},\ldots,t_{i+1}-1\}, \tag{3}\]  
where \(K\in\mathbb{R}^{m\times n}\) denotes the feedback gain matrix and \(\{l(i)\in\{0,1\}\}_{i\in\mathbb{N}_{0}}\) is a binary-valued process that is used for indicating success/failure of packet exchange attempts. Specifically, \(l(i)=0\) indicates that the packet exchange attempt at time \(t_{i}\) is successful, whereas \(l(i)=1\) indicates that either the packet sent from the plant or the packet sent from the controller failed to be delivered at time \(t_{i}\). If there are many packet exchange failures, the overall system can become unstable. This is because, when there is a failure, the system is governed by the unstable open-loop dynamics. Notice that for the wireless networked control system depicted in Figure 1 (left), transmission failures happen due to _jamming attacks_[26].