# An Overview on Denial-of-Service Attacks in Control Systems: Attack Models and Security Analyses
## 2 An Overview of Literature on Denial-of-Service in Control Systems
### Networked Control Problem
#### 2.1.2 Continuous-Time Setting  
In [47; 48], researchers considered event-based remote control of a plant described by a linear continuous-time system  
\[\dot{x}(t) =Ax(t)+Bu(t),\quad x(0)=x_{0},\quad t\geq 0, \tag{4}\] \[y(t) =Cx(t). \tag{5}\]  
The state of the plant is measured at times \(t_{0},t_{1},t_{2},\ldots\in[0,\infty)\) and transmitted on the network to the controller. The control input applied at the plant side is kept constant between each successful transmission over the network. In particular, the input \(u(t)\) at the plant-side is given by  
\[u(t)=Kx(t_{k(t)}), \tag{6}\]  
where \(k(t)\) denotes the index of the last successful transmission time. Notice that, in the control framework in [47; 48], the control input at the plant side is not set to 0, when control data packet transmissions fail. The framework developed in [47] allows resilient control update mechanisms. As we discuss further in Section 5.1.1, the intervals between consecutive transmission attempt times \(t_{0},t_{1},t_{2},\ldots\) are designed to depend on the presence/absence of attacks. For instance, if the transmission attempt at time \(t_{k}\) faces an attack, then the next transmission is attempted shortly afterwards, whereas, if the attempt at time \(t_{k}\) is successful, the next attempt can be made after a longer duration. Similar resilient control setups are provided in the discrete-time setting in [25; 38]. In [47; 48], researchers provide a stability analysis approach for the closed-loop state-feedback control system in Equations (4) and (6) by utilizing bounds on the average duration and the frequency of DoS attacks. The characterization of attacks through average duration and frequency bounds is further discussed in Section 3.1. The analysis approach in [47; 48] does not require the strategy of the attacks to be known, and, moreover, the attacks can be time- or state-dependent. We also note that there are several works where periodic DoS attacks with unknown average duration and frequency are considered. In particular, [PERSON] and [PERSON] [49] provided a detection-based control approach for periodic attacks, where the periodic strategy of the attacker can be learned so that transmission times are selected to avoid overlapping with the attack times. In the case of _output-feedback_ control problem, the utility of several different control frameworks under DoS attacks is investigated in [50; 51; 52]. As we further discuss in Section 5.1.1, [PERSON] and [PERSON] [50] and [PERSON] and [PERSON] [51] provided new architectures to limit the capabilities of attackers. Moreover, [PERSON] and [PERSON] [52] considered the case where multiple sensors make output measurements (\(i\)th sensor attempts to send the \(i\)th output measurement \(y_{i}(t)=C_{i}x(t)\) over the \(i\)th channel). In [53; 54], the effect of DoS attacks on _nonlinear_ systems is explored. Specifically, [PERSON] and [PERSON] [53] investigated the state-feedback control problem, and, moreover, [PERSON] et al. [54] explored dynamic event-based output-feedback controllers for stabilization. In [55], a linearization approach is developed for stabilizing nonlinear systems. There, it is mentioned that, when DoS attacks are sufficiently strong, the trajectories of the state may leave the linearization region, which may in turn cause instability due to the nonlinearity of the dynamics. For the case where the system dynamics involve unknown nonlinear functions, [PERSON] and [PERSON] [56] proposed adaptive controllers to guarantee boundedness of the state under DoS attacks. Networked distributed control of a large-scale system is explored in [57]. There, the subsystems of the large-scale system utilize a shared network for the transmissions of their corresponding measurement and control input packets. To mitigate the effects of DoS, [PERSON] et al. [57] proposed a transmission strategy that switches between event-based transmissions and a Round-robin protocol.