# Research on Dual Security Control for a Non-Linear CPS with Multi-Objective Constraints under DoS Attack and Actuator Fault: An Active-Passive Attack-Tolerant Approach

Authors: Li Zhao; Wei Li; Yajie Li
Journal: Journal of Control Science and Engineering
 (2022)

---

## Abstract

Based on the discrete event-triggered communication scheme (DETCS), a codesign method of dual security control and communication for the non-linear cyberphysical system (CPS) with denial-of-service (DoS) attack and actuator fault is studied under multi-objective constraints. First, to effectively distinguish DoS attacks with different energy levels, the DoS attack detection method is established based on the maximum allowable delay of the system. Second, a non-linear CPS dual security control framework that integrates active-passive attack tolerance for DoS attack and active fault tolerance for actuator fault is constructed. Third, the low-energy DoS attack is regarded as a special kind of time delay, and a robust observer for the estimation of system states and actuator fault is designed, and a codesign method of passive attack tolerance, active fault tolerance, and communication is proposed. Furthermore, a correction compensation algorithm of control quantity is proposed for high-energy DoS attack based on the PID idea to make active-passive attack tolerance more effective. Finally, the effectiveness of the proposed method is verified by the simulation of a quadruple-tank model.


---

## Body

## 1. Introduction

With the wide application of the cyber physical system (CPS) in aerospace, intelligent manufacturing, smart grid, and other fields, its security problems have become increasingly prominent. For example, BlackEnergy3 attacked the Ukrainian power grid [1] and Bitcoin Ransomware (WannaCry) attacked global public and commercial systems [2], which have caused immeasurable losses to national security and economy [3]. In general, CPS insecurity factors mainly come from two aspects. First, the communication network becomes open and interconnected from the traditional closed and isolated, which makes it more vulnerable to various types of cyber attacks and indirectly affects the security of physical plants or even the whole system [4, 5]. Second, the physical components operate under high load or in harsh environment for a long time, resulting in the degradation of core components such as fail of actuators, thus destroying the stability of the system [6, 7]. In addition, most of the actual systems have non-linear characteristic, so it is important to study the security control for a non-linear CPS.Cyber attacks on the CPS mainly include denial-of-service (DoS) [8, 9] and false data injection (FDI) attack [10, 11]. DoS attacks are non-stealthy attacks that often block communication channels and make system communication impossible [12], and the Ukraine power grid incident was caused by using DoS attacks to block communication transmission. Scholars usually model DoS attacks in the CPS as network time delay or packet loss [13–16]. In [17], DoS attack is modeled as bounded packet loss by defining attack frequency and duration. In [18], the packet loss is regarded as a random Bernoulli distribution. In [19], DoS attack is modeled as a Markov process. After the attack model is established, the methods based on control theory are further used to ensure the system security, such as state estimation [20, 21], game theory [22, 23], predictive control [24, 25], and resilient control [26, 27], among which the resilient control has fruitful achievements and it is also the focus of attention. In [28], the asynchronous attack signal is described by recursive characteristics, and a dynamic event-triggered resilient control method is proposed to resist DoS attack. In [29], a resilient control strategy is studied under DoS attack, and furthermore, an H∞ observer is constructed based on the periodic event-triggered control framework. The resilient control problem is studied in [30] based on the sampling data model under DoS attacks, and in order to receive the sampling signal and obtain the attack duration, a logic processor is introduced into the controller. The defense against DoS attacks in that mentioned above is essentially robust to packet loss or time delay caused by finite-energy DoS attacks, and it is a passive attack-tolerant strategy that can only cope with low-energy DoS attacks. Once the packet loss or delay caused by a DoS attack exceeds the maximum allowable range, the system security will not be guaranteed. The active attack-tolerant method can be further used to reconstruct or correct the loss of control quantity caused by high-energy DoS attack, i.e., the combination of active and passive attack tolerance will better guarantee the CPS security. This is one of the motivations in this paper.Although there are many results to deal with DoS attack in the CPS, there is a lack of common consideration of DoS attack and physical system fault. In [31–33], passive, active, and active-passive hybrid fault-tolerant control methods are proposed, respectively, to suppress the impact of faults on the system. In [34], a novel dynamic fault-tolerant control model is proposed. Therefore, the fault-tolerant control provides an effective solution to component faults. However, the impact of DoS attack on the system is not considered in that mentioned above. How to take into account the attack tolerance in a cyber system and the fault tolerance in a physical system and carry out the codesign of dual security control is undoubtedly of great significance for the improvement of CPS security. This is another motivation for the research.The CPS is the integration of the cyber and physical system, and a network communication scheme is important for the coordination of control and communication. The traditional time-triggered communication scheme not only wastes network resources but also the design of the control strategy lacks proper correlation with the communication [35]. The discrete event-triggered communication scheme (DETCS) proposed in [36, 37] relies on “events” rather than “time” for data transmission, which can save network resources and make the collaboration of control and communication possible. Recently, the adaptive event-triggered communication scheme proposed in [38, 39] is able to satisfy the control requirements while saving network resources more effectively, but it is still difficult to achieve the coordination of security control and communication under DoS attack. Besides, the practical engineering has other performance requirements in addition to security. The T-S fuzzy model is a powerful method for the analysis and synthesis of a non-linear system [40]; therefore, based on the T-S fuzzy model and DETCS, it is more challenging and valuable to study the codesign of dual security control and communication for a non-linear CPS with DoS attacks and actuator fault under multi-objective constraints. This is the third research motivation of this study.Based on previous studies, in this paper, the codesign method of dual security control and communication for a non-linear CPS with DoS attacks and actuator fault is investigated. The contributions are as follows:(1)
A DoS attack detection method is proposed based on the maximum allowable delay of the system to distinguish high- and low-energy DoS attacks, and a passive attack-tolerance strategy is used for low-energy DoS attack. Based on the PID idea, the active compensation strategy is designed for the lack of control quantity caused by high-energy DoS attacks, the combination of active and passive attack tolerance strategies can more effectively resist the impact of DoS attacks on the CPS.(2)
A dual security control framework with active-passive attack tolerance and active fault tolerance is constructed for the coexistence of DoS attacks and actuator fault in the CPS. Furthermore, a non-linear CPS closed-loop T-S fuzzy model integrating DoS attack, actuator fault, and attack-tolerant and fault-tolerant control is established, which lays a foundation for the dual security control.(3)
Based on the DETCS, considering the multi-objective constraints, such asα−stability and H∞ performance, the design methods of the observer for state and fault and dual security controller are given, respectively, with the help of less-conservative techniques. Finally, the codesign between dual security control and communication resource saving is realized, and a classical quadruple-tank model is used to verify the effectiveness of the proposed method.The remainder of this paper is organized as follows. The system description is presented in Section2. In Section 3, an observer for system state and actuator fault with multi-objective constraints under DoS attack is designed. The dual security controller is presented in Section 4. The strategy and algorithm of DoS attack detection and active attack tolerance are given in Section 5. Section 6 is the simulation research and result analysis, and the conclusion is presented in Section 7.


## 2. System Description

### 2.1. System Framework

In order to keep the non-linear CPS which suffers from DoS attack and continuous time-varying actuator fault stable, a dual security control framework with active-passive attack tolerance and active fault tolerance is established, as shown in Figure1.Figure 1
Dual security control framework for a non-linear CPS under DoS attack.In Figure1, the system consists of a non-linear controlled plant, an intelligent sensing unit, a control unit, an intelligent execution unit, and dual-end networks.The intelligent sensing unit is composed of a sensor, a sampler, an observer, and an event generator. The control quantity and system output are measured by using a sensor, the measured values are sampled by using a sampler in an equal periodic manner, and the sampled data are observed by the observer to obtain the estimations of system state and fault. After screening by using the event generator, the data that meet the trigger condition are transmitted to the control unit through the sensor network in a non-uniform manner.The control unit includes a dual security controller with passive attack tolerance and active fault tolerance. It mainly completes the calculation of control quantity based on resilient control for DoS attack with low energy and actuator fault, and then, the calculated quantity is transmitted to the execution unit through the control network. Obviously, the calculation of control quantity is also carried out in a nonuniform periodic manner.The intelligent execution unit includes a data buffer, an attack detector, an attack compensator, a zero-order holder (ZOH), and an actuator. The data buffer stores the received control quantity and further implements attack detection. If it is detected that the time delay caused by DoS attack is greater than the maximum allowed value, then it is a high-energy DoS attack. It will be updated and corrected with the help of appropriate compensation algorithm according to the original value of control quantity stored in the early stage. It is further sent to the actuator to achieve active attack tolerance for high-energy DoS attacks. If the time delay is less than the maximum allowed value, it is a low-energy DoS attack, the received data will be directly sent to the actuator, and finally, the control quantity will act on the controlled plant.Remark 1: if the time delay caused by DoS attack approaches or exceeds the maximum allowable delay of the system, the attack is called high-energy DoS attack; otherwise, it is called low-energy DoS attack.Remark 2: the passive attack-tolerant strategy may fail when the system suffers from high-energy DoS attack. At this time, to ensure the system is stable, the active attack-tolerant strategy is implemented to compensate and update the loss of control quantity caused by high-energy DoS attack, so the system has the ability of active-passive attack-tolerant control.Remark 3: according to the characteristic of DoS attack, it can be regarded as a special packet loss and transformed into time delay through the following timing analysis. Based on the maximum allowable delay of the system, the DoS attack detection method is proposed. If the time delay caused by the DoS attack is within the allowable range, the passive attack tolerance is used. On the contrary, the active attack-tolerant strategy is used to compensate the loss of control quantity caused by the DoS attack. Finally, the system remains stable under both high- and low-energy DoS attacks.Assumption 1.
The energy of DoS attack is limited, and its impact on the system is regarded as a special kind of packet loss, and the amount of packets lost is limited.Assumption 2.
Natural packet loss rarely occurs during data transmission, and a single packet with time stamp is used for data transmission.


### 2.2. Description of the Controlled Plant

As shown in Figure1, it can be seen that the output of the continuous non-linear controlled plant is sampled and transmitted to the intelligent sensing unit and control unit, and then, both estimation and calculation are digital quantities. Therefore, the system is a typical sampling data system [41]. Based on the T-S fuzzy model, the non-linear CPS with actuator continuous time-varying fault is modeled as follows:(1)x˙t=∑i=1rξiθtAixt+Biut+Efift+Ewiwt,yikh=∑i=1rξiθtCixikh+Evivikh,where ξiθt=aiθt/∑i=1Naiθt,ξiθt is the weight ratio representing each fuzzy rule, aiθt=∏j=1NMijθjt, Mijθjt is the membership function of θjt with respect to Mij, let aiθt≥0i=1,2,⋯,N and ∑i=1Naiθt>0, and then, ξiθt≥0 and ∑i=1Nξiθt=1. Ai,Bi,Efi,Ewi,Ci,Evi are matrices with known appropriate dimensions, and xt∈Rn,ut∈Rnu are the system state and the control input vector, respectively. ft∈Rnf is a continuous time-varying actuator fault, and its derivative is assumed to be bounded; i.e., there is a constant f1 such that f˙t≤f1. wt∈Rnw,yikh∈Rm, and vikh∈Rnv are the system disturbance, output sampling, and measurement noise.In order to effectively save network resources and realize the codesign of communication and control, the following classic DETCS [36] is adopted:(2)eTik1hΦeik1h≤σsx^Ttk2hΦx^tk2h.In the trigger condition equation (2), the trigger parameter σs is given in advance, δs∈0,1, and it is related to the expected performance of the system. The positive definite symmetric matrix Φ is to be designed. eik1h=x^ik1h−x^tk2h is the state estimation error, x^ik1h is the system state estimation at the current time, and x^tk2h is the system state estimation that meets the event trigger condition at the previous time.Assumption 3.
The sampler is clock driven in an equal period, the sampling period ish, and the corresponding sequence is ik1,k1=0,1,2,⋯. The controller and actuator are event driven, and the filtered data trigger period is recorded as htk2,htk2=tk2+1−tk2h, and the transmission sequence is tk2,k2=0,1,2,⋯. After the DoS attack invasion, the period of successful transmission of the filtered data by the event generator is hjk3,hjk3=jk3+1−jk3h, the transmission sequence is jk3, k3=0,1,2,⋯, and the interval satisfies tk2=mik1,jk3=nik1, where m,n are integers.


### 2.3. Analysis of Time-Delay Interval

Although the controlled plant is continuous, the calculation of the observer and controller is carried out in the form of digital quantity. In addition, the introduction of the DETCS makes the filtered data transmitted in a non-uniform manner. Based on the time-delay system theory method in [42], the non-uniform transmission property is transformed into time delay for the typical sampling data system, and the design method of observer and controller are studied in a continuous manner.The output sampling of the intelligent sensing unit is carried out in an equal periodic manner, and its period ish. With the help of time-delay system theory, the sampling period in adjacent sampling points is transformed into time delay, and then, the system is designed and analyzed in a continuous manner.The delay function is defined as(3)τ1t=t−ik1h,where t∈ik1h,ik1+1h and 0<τ1t≤h1=h. The time sequence of the sampled, filtered, and transmitted data is shown in Figure 2.Figure 2
Time sequence of updated data for a non-linear CPS under DoS attack.As shown in Figure2, the amount of consecutive packet losses caused by DoS attack is τtk2DoS∈0,τMDoS. htk2max is the non-uniform maximum trigger period, and then, the actual maximum duration of DoS attack is τMDoShtk2max. ik1h is the sampled data sequence, and tk2h is the triggered data sequence. jk3h is the transmitted sequence to the ZOH (without considering transmission delay), and it satisfies the relationship jk3h=tk2h+τtk2DoShtk2.Whenx^jk3h and f^jk3h are transmitted to the front end of the ZOH, while x^jk3+1h and f^jk3+1h are not sent to the ZOH, the transmission interval is Λ=jk3h,jk3+1h.The delay function is defined as(4)τ2t=t−jk3h.Then, its upper bound is(5)h2=maxhtk2+τtk2DoShtk2=htk2max+τMDoShtk2max.The lower bound is0<τmin=minτtk2DoShtk2, where the time-delay function satisfies 0<τmin≤τ2t≤h2. For the convenience of analysis, ik1h, tk2h, and jk3h will be recorded as ik1, tk2, and jk3.


## 2.1. System Framework

In order to keep the non-linear CPS which suffers from DoS attack and continuous time-varying actuator fault stable, a dual security control framework with active-passive attack tolerance and active fault tolerance is established, as shown in Figure1.Figure 1
Dual security control framework for a non-linear CPS under DoS attack.In Figure1, the system consists of a non-linear controlled plant, an intelligent sensing unit, a control unit, an intelligent execution unit, and dual-end networks.The intelligent sensing unit is composed of a sensor, a sampler, an observer, and an event generator. The control quantity and system output are measured by using a sensor, the measured values are sampled by using a sampler in an equal periodic manner, and the sampled data are observed by the observer to obtain the estimations of system state and fault. After screening by using the event generator, the data that meet the trigger condition are transmitted to the control unit through the sensor network in a non-uniform manner.The control unit includes a dual security controller with passive attack tolerance and active fault tolerance. It mainly completes the calculation of control quantity based on resilient control for DoS attack with low energy and actuator fault, and then, the calculated quantity is transmitted to the execution unit through the control network. Obviously, the calculation of control quantity is also carried out in a nonuniform periodic manner.The intelligent execution unit includes a data buffer, an attack detector, an attack compensator, a zero-order holder (ZOH), and an actuator. The data buffer stores the received control quantity and further implements attack detection. If it is detected that the time delay caused by DoS attack is greater than the maximum allowed value, then it is a high-energy DoS attack. It will be updated and corrected with the help of appropriate compensation algorithm according to the original value of control quantity stored in the early stage. It is further sent to the actuator to achieve active attack tolerance for high-energy DoS attacks. If the time delay is less than the maximum allowed value, it is a low-energy DoS attack, the received data will be directly sent to the actuator, and finally, the control quantity will act on the controlled plant.Remark 1: if the time delay caused by DoS attack approaches or exceeds the maximum allowable delay of the system, the attack is called high-energy DoS attack; otherwise, it is called low-energy DoS attack.Remark 2: the passive attack-tolerant strategy may fail when the system suffers from high-energy DoS attack. At this time, to ensure the system is stable, the active attack-tolerant strategy is implemented to compensate and update the loss of control quantity caused by high-energy DoS attack, so the system has the ability of active-passive attack-tolerant control.Remark 3: according to the characteristic of DoS attack, it can be regarded as a special packet loss and transformed into time delay through the following timing analysis. Based on the maximum allowable delay of the system, the DoS attack detection method is proposed. If the time delay caused by the DoS attack is within the allowable range, the passive attack tolerance is used. On the contrary, the active attack-tolerant strategy is used to compensate the loss of control quantity caused by the DoS attack. Finally, the system remains stable under both high- and low-energy DoS attacks.Assumption 1.
The energy of DoS attack is limited, and its impact on the system is regarded as a special kind of packet loss, and the amount of packets lost is limited.Assumption 2.
Natural packet loss rarely occurs during data transmission, and a single packet with time stamp is used for data transmission.


## 2.2. Description of the Controlled Plant

As shown in Figure1, it can be seen that the output of the continuous non-linear controlled plant is sampled and transmitted to the intelligent sensing unit and control unit, and then, both estimation and calculation are digital quantities. Therefore, the system is a typical sampling data system [41]. Based on the T-S fuzzy model, the non-linear CPS with actuator continuous time-varying fault is modeled as follows:(1)x˙t=∑i=1rξiθtAixt+Biut+Efift+Ewiwt,yikh=∑i=1rξiθtCixikh+Evivikh,where ξiθt=aiθt/∑i=1Naiθt,ξiθt is the weight ratio representing each fuzzy rule, aiθt=∏j=1NMijθjt, Mijθjt is the membership function of θjt with respect to Mij, let aiθt≥0i=1,2,⋯,N and ∑i=1Naiθt>0, and then, ξiθt≥0 and ∑i=1Nξiθt=1. Ai,Bi,Efi,Ewi,Ci,Evi are matrices with known appropriate dimensions, and xt∈Rn,ut∈Rnu are the system state and the control input vector, respectively. ft∈Rnf is a continuous time-varying actuator fault, and its derivative is assumed to be bounded; i.e., there is a constant f1 such that f˙t≤f1. wt∈Rnw,yikh∈Rm, and vikh∈Rnv are the system disturbance, output sampling, and measurement noise.In order to effectively save network resources and realize the codesign of communication and control, the following classic DETCS [36] is adopted:(2)eTik1hΦeik1h≤σsx^Ttk2hΦx^tk2h.In the trigger condition equation (2), the trigger parameter σs is given in advance, δs∈0,1, and it is related to the expected performance of the system. The positive definite symmetric matrix Φ is to be designed. eik1h=x^ik1h−x^tk2h is the state estimation error, x^ik1h is the system state estimation at the current time, and x^tk2h is the system state estimation that meets the event trigger condition at the previous time.Assumption 3.
The sampler is clock driven in an equal period, the sampling period ish, and the corresponding sequence is ik1,k1=0,1,2,⋯. The controller and actuator are event driven, and the filtered data trigger period is recorded as htk2,htk2=tk2+1−tk2h, and the transmission sequence is tk2,k2=0,1,2,⋯. After the DoS attack invasion, the period of successful transmission of the filtered data by the event generator is hjk3,hjk3=jk3+1−jk3h, the transmission sequence is jk3, k3=0,1,2,⋯, and the interval satisfies tk2=mik1,jk3=nik1, where m,n are integers.


## 2.3. Analysis of Time-Delay Interval

Although the controlled plant is continuous, the calculation of the observer and controller is carried out in the form of digital quantity. In addition, the introduction of the DETCS makes the filtered data transmitted in a non-uniform manner. Based on the time-delay system theory method in [42], the non-uniform transmission property is transformed into time delay for the typical sampling data system, and the design method of observer and controller are studied in a continuous manner.The output sampling of the intelligent sensing unit is carried out in an equal periodic manner, and its period ish. With the help of time-delay system theory, the sampling period in adjacent sampling points is transformed into time delay, and then, the system is designed and analyzed in a continuous manner.The delay function is defined as(3)τ1t=t−ik1h,where t∈ik1h,ik1+1h and 0<τ1t≤h1=h. The time sequence of the sampled, filtered, and transmitted data is shown in Figure 2.Figure 2
Time sequence of updated data for a non-linear CPS under DoS attack.As shown in Figure2, the amount of consecutive packet losses caused by DoS attack is τtk2DoS∈0,τMDoS. htk2max is the non-uniform maximum trigger period, and then, the actual maximum duration of DoS attack is τMDoShtk2max. ik1h is the sampled data sequence, and tk2h is the triggered data sequence. jk3h is the transmitted sequence to the ZOH (without considering transmission delay), and it satisfies the relationship jk3h=tk2h+τtk2DoShtk2.Whenx^jk3h and f^jk3h are transmitted to the front end of the ZOH, while x^jk3+1h and f^jk3+1h are not sent to the ZOH, the transmission interval is Λ=jk3h,jk3+1h.The delay function is defined as(4)τ2t=t−jk3h.Then, its upper bound is(5)h2=maxhtk2+τtk2DoShtk2=htk2max+τMDoShtk2max.The lower bound is0<τmin=minτtk2DoShtk2, where the time-delay function satisfies 0<τmin≤τ2t≤h2. For the convenience of analysis, ik1h, tk2h, and jk3h will be recorded as ik1, tk2, and jk3.


## 3. Observer Design for System State and Actuator Fault with Multi-Objective Constraints under DoS Attack

Design objective: under the DETCS, considering DoS attack and actuator fault, the designed observer can accurately estimate the system state and actuator fault in real time withα− stability and H∞ performance.According to the dual security control framework for a non-linear CPS in Figure1 and the analysis in Section 2.3, the output characteristics of the system are considered as time delay in one sampling period [43], and the system output is obtained as follows by combining with equations (1) and (3):(6)yt=∑i=1rξiθtCixt−τ1t+Evivt−τ1t.Constructing an observer for the estimation of state and fault,(7)x^˙t=∑i=1r∑j=1rξiθtξjθtAix^t+Biut+Efif^t−Ljy^t−yt,y^t=∑i=1rξiθtCix^t−τ1t,f^˙t=∑i=1rξiθt−Fjeyt,where x^t,y^t,f^t represent the estimations of system state, observer output, and fault, respectively, and Lj,Fj are the observer and fault estimation gain matrix.We defineext=x^t−xt, eyt=y^t−yt, and eft=f^t−ft, and the following error system is obtained:(8)e˙xt=x^˙t−x˙t=∑i=1r∑j=1rξiθtξjθtAiext+Efieft−LjCiext−τ1t+LjEvit−τ1t−Ewiwt,eyt=∑i=1rξiθtCiext−τ1t−Evivt−τ1t.The derivative of the fault estimation error with respect to time is(9)e˙ft=∑i=1r∑j=1rξiθtξjθt−FjCiext−τ1t+FjEvivt−τ1t−f˙t.Equations (8) and (9) are augmented to the following system:(10)e¯˙t=∑i=1r∑j=1rξiθtξjθtA¯ie¯t−E¯wiw¯t−L¯jC¯ie¯t−τ1t+L¯jEvivt−τ1t,where(11)A¯i=AiEfi00,e¯t=exteft,C¯i=Ci0,L¯j=LjFj,E¯wi=Ewi00I,w¯t=wtf˙t.Theorem 1.
Considering the augmented error system in equation (10) with actuator fault and DoS attacks, given positive numbers α1, h1, and γ1, ni,i=1,2,3, if there exist symmetric matrix P>0 and appropriate dimensional matrices X,Y, the following matrix inequalities hold:(12)Γ11Γ12Γ13Γ140∗Γ22Γ23Γ24h1n1e2α1τ1tC¯iTYjT∗∗Γ33Γ340∗∗∗Γ440∗∗∗∗−h1n1e2α1τ1tP<0,(13)Γ11'Γ12'Γ13Γ14X∗Γ22'Γ23Γ24X∗∗Γ33Γ34X∗∗∗Γ44X∗∗∗∗−15n123h1P<0,(14)Λ11Λ12Λ13Λ14Λ15Λ160∗Λ22Λ23Λ24Λ25Λ26Λ27∗∗Λ33Λ34000∗∗∗Λ44000∗∗∗∗Λ55Λ56Λ57∗∗∗∗∗Λ660∗∗∗∗∗∗Λ77<0,(15)Λ11′Λ12′Λ13′Λ14′Λ15′Λ16′X∗Λ22′Λ23′Λ24′00X∗∗Λ33′Λ34′00X∗∗∗Λ44′00X∗∗∗∗Λ55′00∗∗∗∗∗Λ66′0∗∗∗∗∗∗Λ77′<0.Then, the system equation (10) has α− stability and meets the following H∞ performance index:(16)e¯α1t22≤γ12w¯α1t22+∑k1=0+∞ik1+1−ik1vα1ik122.The gain matrixLj and Fj can be obtained by L¯j=LjFj, where(17)Γ11=PA¯i+A¯iTP−n2P−3X−3XT+h1n1A¯iTPA¯i+h1n2PA¯i+A¯iTP,Γ13=2X−3XT,Γ14=6X−3XT,Γ12=−eα1τ1tYjC¯i+n2P+X−3XT−h1n2A¯iTP−h1n2eα1τ1tYjC¯i−h1n1eα1τ1tA¯iTYjC¯i,Γ22=h1n3P−n2P+X+XT+h1n2eα1τ1tYjC¯i+h1n2eα1τ1tC¯iTYjT,Γ23=2X+XT,Γ24=6X+XT,Γ33=2X+2XT,Γ34=6X+2XT,Γ44=6X+6XT,Γ11′=PA¯i+A¯iTP−n2P−3X−3XT,(18)Γ12′=−eα1τ1tYjC¯i+n2P+X−3XT,Γ22′=−h1n3P−n2P+X+XT,Λ11=PA¯i+A¯iTP−n2P−3X−3XT+I+h1n1A¯iTPA¯i+h1n2PA¯i+A¯iTP,Λ12=Γ12,Λ13=Γ13,Λ14=Γ14,Λ15=eα1τ1tYjEvi+h1n1eα1τ1tA¯iTYjEvi+h1n2eα1τ1tYjEvi,Λ16=−PE¯wi−h1n1A¯iTPE¯wi−h1n2PE¯wi,Λ22=Γ22,Λ23=Γ23,Λ24=Γ24,Λ25=−h1n2eα1τ1tYjEvi,Λ26=h1n1eα1τ1tC¯iTYjTE¯wi+h1n2PE¯wi,Λ55=−γ12I,Λ27=h1n1e2α1τ1tC¯iTYjT,Λ33=Γ33,Λ34=Γ34,Λ44=Γ44,Λ56=−h1n1eα1τ1tEviTYjTE¯wi,Λ57=h1n1e2α1τ1tEviTYjT,Λ66=−γ12I+h1n1E¯wiTPE¯wi,Λ77=−h1n1e2α1τ1tP,Λ11′=Γ11′+I,Λ12′=Γ12′,Λ13′=Γ13,Λ14′=Γ14,Λ15′=eα1τ1tYEvi,Λ16′=−PE¯wi,Λ23′=Γ23,Λ24′=Γ24,Λ22′=−h1n3P−n2P+X+XT,Λ33′=Γ33,Λ34′=Γ34,Λ44′=Γ44,Λ55′=−γ12I,Λ66′=−γ12I,Λ77′=−15n123h1P.Proof.
Introducing the state transformationxt=e−α1tζt, equations (1) and (6) can be transformed into the following forms:(19)ζ˙t=∑i=1rξiθtA˜iζt+Βiuα1t+Efifα1t+Ewiwα1t,yα1t=∑i=1rξiθtCiζt−τ1t+Evivα1t−τ1t,where(20)A˜i=Ai+α1I,uα1t=eα1tut,fα1t=eα1tft,wα1t=eα1twt,yα1t=eα1t−τ1tyt,vα1t−τ1t=eα1t−τ1tvt−τ1t.
The state transformationx^t=e−α1tζ^t is also introduced to obtain an observer for system state and fault estimation with α− stability:(21)ζ^˙t=∑i=1r∑j=1rξiθtξjθtA˜iζ^t+Biuα1t+Efif^α1t−Ljeα1τ1ty^α1t−yα1t,y^α1t=∑i=1rξiθtCiζ^t−τ1t,f^˙α1t=∑i=1rξjθt−eα1τ1tFjeyα1t,where ζ^t, y^α1t, and f^α1t are the estimations of system state, the observer output, and the actuator fault, respectively.
We defineeyα1t=y^α1t−yα1t,efα1t=f^α1t−fα1t, and then, the following error system can be obtained:(22)e˙xα1t=∑i=1r∑j=1rξiθtξjθtA˜iexα1t+Efiefα1t−Ewiwα1t−LjCieα1τ1texα1t−τ1t+LjEvieα1τ1tvα1t−τ1t,eyα1t=∑i=1rξiθtCiexα1t−τ1t−Evivα1t−τ1t.
The derivative of the fault estimation error with respect to time is(23)e˙fα1t=∑i=1r∑j=1rξiθtξjθt−eα1τ1tFjCiexα1t−τ1t+FjEvivα1t−τ1t−f˙α1t.
The estimation errors of system state and fault are augmented into the following system:(24)e¯˙α1t=∑i=1r∑j=1rξiθtξjθtA¯ie¯α1t−E¯wiw¯α1t−L¯jC¯ieα1τ1te¯α1t−τ1t+L¯jEvieα1τ1tvα1t−τ1t.
We define(25)A¯i=A˜iEfi00,e¯α1t=exα1tefα1t,C¯i=Ci0,L¯j=LjFj,w¯α1t=wα1tf˙α1t,E¯wi=Ewi00I.
According to the definition ofα− stability, when the system equation (24) is asymptotically stable, the augmented error system equation (10) has α− stability.
In order to ensure the system equation (24) is asymptotically stable, let w¯α1t=0 and vα1t−τ1t=0, and the following Lyapunov functional is constructed:(26)V1t=e¯α1TtPe¯α1t+h1−τ1tφ1TtSφ1t+h1−τ1tτ1te¯α1Tt−τ1tQe¯α1t−τ1t+h1−τ1t∫t−τ1tte¯˙α1TsRe¯˙α1sds,where(27)P=PT>0,Q=QT>0,R=RT>0,S=ST>0,φ1t=e¯α1t−e¯α1t−τ1t.
Derivation ofV1t along the system equation (24):(28)V˙1t=2e¯α1TtPe¯˙α1t−∫t−τ1tte¯˙α1TsRe¯˙α1sds−h1e¯α1Tt−τ1tQe¯α1t−τ1t+2h1−τ1te¯α1Tt−τ1tQe¯α1t−τ1t+h1−τ1te¯˙α1TtRe¯˙α1t−φ1TtSφ1t+2h1−τ1tφ1TtSe¯˙α1t.
In order to deal with the integral term in equation (28), the affine Bessel–Legendre inequality in [44] is adopted; i.e.,(29)−∫t−τ1tte¯˙α1TsRe¯˙α1sds≤−ψ1TtΔψ1t,where(30)ψ1Tt=e¯α1Tte¯α1Tt−τ1t1τ1tΞ0T1τ1tΞ1T,Ξ0=∫t−τ1tte¯α1sds,Ξ1=∫t−τ1tt2s−t+τ1tτ1t−1e¯α1sds,Δ=XH2+H2TXT−τ1tXR¯XT,H2=I−I00II−2I0I−I0−6I,R¯=diagR−113R−115R−1.
Substituting the inequality in equation (29) into equation (28), let(31)Ν11=I000,Ν12=A¯i−eα1τ1tL¯jC¯i00,Ν13=0I00,Ν14=I−I00,and then,(32)e¯α1t=Ν11ψ1t,e¯˙α1t=Ν12ψ1t,e¯α1t−τ1t=Ν13ψ1t,φ1t=Ν14ψ1t,so(33)V˙1t≤ψ1TtΩ11+h1−τ1tΩ12+τ1tΩ13ψ1t,where(34)Ω11=2Ν11TPΝ12−h1Ν13TQΝ13−Ν14TSΝ14−XH2−H2TXT,Ω12=2Ν13TQΝ13+Ν12TRΝ12+2Ν14TSΝ12,Ω13=XR¯XT.
WhenΩ11+h1−τ1tΩ12+τ1tΩ13<0 is established, according to Lyapunov stability theory, the system equation (24) is asymptotically stable; i.e., the augmented error system equation (10) has α−stability.
Using the linear convex combinatorial lemma [45], it is obtained that the necessary and sufficient conditions for h1−τ1tΩ12+τ1tΩ13<0 are as follows:(35)Ω11+h1Ω12<0,Ω11+h1Ω13<0.
Under the zero initial condition, whenvα1t−τ1t≠0,w¯α1t≠0, considering the H∞ performance index function,(36)J1=V˙1t+e¯α1Tte¯α1t−γ12w¯α1Ttw¯α1t+vα1Tt−τ1tvα1t−τ1t<0.
Let(37)ψ2Tt=e¯α1Tte¯α1Tt−τ1t1τ1tΞ0T1τ1tΞ1Tvα1Tt−τ1tw¯α1Tt,Ν21=I00000,Ν22=A¯i−eα1τ1tL¯jC¯i00eα1τ1tL¯jEvi−E¯wi,Ν23=0I0000,Ν24=I−I0000,Ν25=I000000I000000I000000I00,Ν26=0000I000000I,and then,(38)e¯α1t=Ν21ψ2t,e¯˙α1t=Ν22ψ2t,e¯α1t−τ1t=Ν23ψ2t,φ1t=Ν24ψ2t,ψ1t=Ν25ψ2t,vα1Tt−τ1tw¯α1TtT=Ν26ψ2t.
Therefore, the following can be obtained:(39)J1≤ψ2TtΩ21+h1−τ1tΩ22+τ1tΩ23ψ2t<0,where(40)Ω21=2Ν21TPΝ22−h1Ν23TQΝ23−Ν24TSΝ24−γ12Ν26TΝ26−Ν25TXH2+H2TXTΝ25+Ν21TΝ21,Ω22=2Ν23TQΝ23+Ν22TRΝ22+2Ν24TSΝ22,Ω23=Ν25TXR¯XTΝ25.
Furthermore, according to the linear convex combination lemma, the necessary and sufficient conditions forΩ21+h1−τ1tΩ22+τ1tΣ23<0 are(41)Ω21+h1Ω22<0,Ω21+h1Ω23<0.
LetR=n1P,S=n2P,Q=n3P,PL¯j=Yj, the non-linear matrix inequalities in equations (35) and (41) can be changed into linear, and furthermore, equations (12)–(15) can be obtained by using the Schur complement lemma.
Integrating equation (36) from 0 to +∞,(42)V1+∞−V10≤−∫0+∞e¯α1Tte¯α1tdt+γ12∫0+∞w¯α1Ttw¯α1tdt+∑k1=0+∞ik1+1−ik1vα1Tik1vα1ik1,where V10=0,V1+∞≥0,w¯α1t∈L20,+∞.
vα1ik1∈L20,+∞; thus,(43)∫0+∞e¯α1Tte¯α1tdt≤γ12∫0+∞w¯α1Ttw¯α1tdt+∑k1=0+∞ik1+1−ik1vα1Tik1vα1ik1.
So,e¯α1t22≤γ12w¯α1t22+∑k1=0+∞ik1+1−ik1vα1ik122 is established, and the relevant H∞ performance index is verified.Remark 4.
As demonstrated in [44], although the addition of matrix X increases the decision variable and the computational complexity when affine Bessel–Legendre inequality deals with the integral term, the conservatism can be significantly reduced, which can increase the solution space and enhance the attack defense ability of the system.


## 4. Dual Security Controller for a Non-Linear CPS with Multi-Objective Constraints under DoS Attack

Design objective: under the DETCS, in order to maintain the closed-loop fault system is asymptotically stable and hasα−stability, the dual security controller gain and event trigger matrix are obtained cooperatively, and finally, the system has good dual security under the dual threat of DoS attacks and actuator fault, and network resources can be saved at the same time.Under the DETCS, the non-uniform transmission period is transformed into time-varying delayτ2t, and taking into account the fault accommodation and the ability of attack tolerance, the dynamic output feedback security controller is adopted as follows:(44)ut=∑i=1r∑j=1rξiθtξjθtKjx^t−τ2t−Bi+Efif^t−τ2t,where t∈jk3,jk3+1, the dual security controller gain matrix is Kj∈Rnu×n, and Kjx^t−τ2t is the dynamic output feedback term. The fault accommodation matrix Bi+∈Rnu×n satisfies I−BiBj+Efi=0, rankBi,Efi=rankBi, and −Bi+Efif^t−τ2t is the fault compensation term.Substituting equation (44) into equation (1), a non-linear closed-loop CPS model integrating attack-tolerant and fault-tolerant control can be obtained:(45)x˙t=∑i=1r∑j=1rξiθtξjθtAixt+BiKjxt−τ2t+BiKjext−τ2t−Efieft−τ2t+Ewiwt+τ2tEfif˙t.Theorem 2.
Considering the non-linear CPS in equation (45) with actuator time-varying fault ft and DoS attacks, under the DETCS, given positive numbers ni,mi,i=1,2,3,α2,h2,γ2,δs, if there are symmetric positive definite matrix P˜>0 and appropriate dimensioned matrices X˜,K1j,Q1,Q3,Q5, the following matrix inequalities hold:(46)Π11Π12Π13Π1400∗Π22Π23Π24Π25Π26∗∗Π33Π3400∗∗∗Π4400∗∗∗∗Π550∗∗∗∗∗Π66<0,(47)Π11'Π12'Π13Π140X˜∗Π22'Π23Π24Π25X˜∗∗Π33Π340X˜∗∗∗Π440X˜∗∗∗∗Π550∗∗∗∗∗Π66'<0,(48)Τ11Τ12∗Τ22<0,(49)Τ11′Τ12′∗Τ22′<0,(50)Q1EfiTP˜∗m1P˜>0,Q3n1EfiTP˜∗m2P˜>0,Q5n2EfiTP˜∗m3P˜>0.Then, the system equation (45) has α−stability and meets the H∞ performance index(51)ηt22≤γ22wα2t22+∑k3=0+∞jk3+1−jk3exα2jk322+efα2jk322,and dual security controller gain Kj=P˜Bi+K1j and trigger weight matrix Φ are obtained cooperatively.Here,(52)Π11=P˜A⌣i+A⌣iTP˜−n1P˜+h224m3A⌣iTP˜A⌣i+h224m2P˜+h2n2A⌣iTP˜A⌣i+h2n1P˜A⌣i+A⌣iTP˜−3X˜−3X˜T,Π12=eα2τ2tK1j+n1P˜+h2n1K1j−h2n1A⌣iTP˜+X˜−3X˜T+h224m3eα2τ2tA⌣iTK1j−h224m2P˜+h2n2eα2τ2tA⌣iTK1j,Π13=2X˜−3X˜T,Π14=6X˜−3X˜T,Π22=h2n3P˜−n1P˜+h224m2P˜−h2n1K1j+K1jT+X˜+X˜T,(53)Π23=2X˜+X˜T,Π24=6X˜+X˜T,Π25=h224m3e2α2τ2tK1jT,Π26=h2n2e2α2τ2tK1jT,Π33=2X˜+2X˜T,Π34=6X˜+2X˜T,Π44=6X˜+6X˜T,Π55=−h224m3e2α2τ2tP˜,Π66=−h2n2e2α2τ2tP˜,Π11′=P˜A⌣i+A⌣iTP˜−n1P˜+h224m3A⌣iTP˜A⌣i+h224m2P˜+h2m1P˜−3X˜−3X˜T,Π12′=eα2τ2tK1j+n1P˜+X˜−3X˜T+h224m3eα2τ2tA⌣TK1j−h224m2P˜,Π66'=−15n223h2P˜,Π22′=−h2n3P˜−n1P˜+h224m2P˜+X˜+X˜T,Ψ11=Π11+I,Ψ12=Π12,Ψ13=Π13,Ψ14=Π14,Ψ15=eα2τ2tK1j+h2n2eα2τ2tA⌣iTK1j+h2n1eα2τ2tK1j,+h224m3eα2τ2tA⌣iTK1j,Ψ16=−h224m3eα2τ2tA⌣iTP˜Efi−eα2τ2tP˜Efi−h2n2eα2τ2tA⌣iTP˜Efi−h2n1eα2τ2tP˜Efi,Τ11=Ψ11Ψ12Ψ13Ψ14Ψ15Ψ16∗Ψ22Ψ23Ψ24Ψ25Ψ26∗∗Ψ33Ψ3400∗∗∗Ψ4400∗∗∗∗Ψ55Ψ56∗∗∗∗∗Ψ66,Τ12=Ψ170000Ψ27000h2n2e2α2τ2tK1jT0000000000Ψ57000h2n2e2α2τ2tK1jTΨ670000,(54)Τ22=Ψ770000∗σsΦ000∗∗−Φ00∗∗∗00∗∗∗∗−h2n2e2α2τ2tP˜,Ψ17=P˜Bwi+h224m3A⌣iTP˜Ewi+h2n1P˜Ewi,Ψ22=h2n3P˜−n1P˜+X˜+X˜T+h224m2P˜−h2n1eα2τ2tK1j+K1jT,Ψ23=Π23,Ψ24=Π24,Ψ25=−h2n1eα2τ2tK1j,Ψ26=h2n1eα2τ2tP˜Efi−h224m3e2α2τ2tK1jTEfi−h2n2e2α2τ2tK1jTEfi,Ψ27=−h224m3eα2τ2tK1jTEwi,(55)−h2n2eα2τ2tK1jTEwi−h2n1P˜Ewi,Ψ33=Π33,Ψ34=Π34,Ψ44=Π44,Ψ55=−γ22I,Ψ56=−h224m3e2α2τ2tK1jTEfi−h2n2e2α2τ2tK1jTEfi,Ψ57=h224m3eα2τ2tK1jTEwi+h2n2eα2τ2tK1jTEwi,Ψ66=h224m3e2α2τ2tEfiTP˜Efi+h2n2e2α2τ2tEfiTP˜Efi−γ22I,Ψ67=−h224m3eα2τ2tEfiTP˜Ewi−h2n2eα2τ2tEfiTP˜Ewi,Ψ77=−γ22I+h224m3EwiTP˜Ewi+h2n2EwiTP˜Ewi,Τ11'=Ψ11'Ψ12'Ψ13'Ψ14'Ψ15'Ψ16'∗Ψ22'Ψ23'Ψ24'0Ψ26'∗∗Ψ33'Ψ34'00∗∗∗Ψ44'00∗∗∗∗Ψ55'Ψ56'∗∗∗∗∗Ψ66',Τ12'=Ψ17'00X˜0Ψ27'00X˜h224m3e2α2τ2tK1jT000X˜0000X˜0Ψ57'000h224m3e2α2τ2tK1jTΨ67'0000,(56)Τ22'=Ψ77'0000∗σsΦ000∗∗−Φ00∗∗∗−15n223h2P˜0∗∗∗∗−h224m3e2α2τ2tP˜,Ψ11'=Π11'+I,Ψ12'=Π12',Ψ13'=Π13,Ψ14'=Π14,Ψ15'=eα2τ2tK1j+h224m3eα2τ2tA⌣iTK1j,Ψ16'=−eα2τ2tP˜Efi−h224m3eα2τ2tA⌣iTP˜Efi,Ψ17'=P˜Ewi+h224m3A⌣iTP˜Ewi,Ψ22'=−h2n3P˜−n1P˜+X˜+X˜T+h224m2P˜,Ψ23'=Π23,Ψ24'=Π24,Ψ26=−h224m3e2α2τ2tK1jTEfi,Ψ27'=−h224m3eα2τ2tK1jTEwi,Ψ33'=Π33,Ψ34'=Π34,(57)Ψ44'=Π44,Ψ55'=Π55,Ψ56'=−h224m3e2α2τ2tK1jTEfi,Ψ57'=h224m3eα2τ2tK1jTEwi,Ψ66=−γ22I+h224m3e2α2τ2tEfiTP˜Efi,Ψ67'=−h224m3eα2τ2tEfiTP˜Ewi,Ψ77'=−γ22I+h224m3EwiTP˜Ewi.Proof.
The proof of Theorem2 is similar to Theorem 1, and it will not be elaborated here.Remark 5.
When the performance indexα2 and γ2 are limited, the maximum allowable delay h2m can be obtained by the following formula:(58)maxP˜,X˜,K1,Q1,Q3,Q5,α2,γ2h2ms.t.P˜>0,46,47,48,49,50.
Furthermore, the maximum allowable consecutive packet losses under DoS attacks can be obtained through equation (5).(59)τMaDoS=h2m−htk2maxhtk2max,where ⌊⌋ is the downward rounding symbol and τMaDoS is the upper bound of the maximum consecutive packet losses caused by DoS attack.


## 5. Strategy and Algorithm of DoS Attack Detection and Active Attack Tolerance

### 5.1. Strategy of Attack Detection and Attack Tolerance

After the maximum allowable time delayh2m is obtained through equation (58), in the process of data transmission, it is assumed that the control quantities ujk3h and ujk3+1h are transmitted to the intelligent execution unit at instant jk3h and jk3+1h, respectively, and set hjk3=jk3+1h−jk3h as the transmission interval of two consecutive received control quantities. In order to ensure that the non-linear CPS has a certain security margin when DoS attack occurs, the security factor β is set, and β∈0,1.Whenhjk3<βh2m, the non-linear CPS is not subject to DoS attack or is subject to a low-energy DoS attack, and it is sufficient to implement a passive attack-tolerance strategy at this time. When hjk3≥βh2m, it is detected that the duration of DoS attack is close to or exceeds the maximum allowed time delay; i.e., this is a high-energy DoS attack intrusion. The passive attack-tolerant strategy can no longer meet the system requirements, and a more targeted active attack-tolerant strategy needs to be adopted. The strategy of DoS attack detection and attack-tolerance is shown in Figure 3.Figure 3
Schematic diagram of the strategy of DoS attack detection and attack-tolerance.


### 5.2. Active Attack-Tolerant Algorithm for DoS Attack

At instantjk3+1h, the latest control quantities stored in the data buffer of the intelligent execution unit are ujk3h and ujk3−1h. Whether the current control quantity ujk3+1h is transmitted or corrected depends on whether a DoS attack is high energy.Oncehjk3≥βh2m, it means that high-energy DoS attack invaded the system, and the current control quantity is blocked from transmission. At this time, if the system can compensate for the lack of control quantity caused by high-energy attack based on the previously stored in the data buffer, then the system can tolerate high-energy DoS attack in an active way.Table 1
Algorithm of DoS attack detection and control quantity compensation.
Step 1: the time interval between two consecutive received control quantities is obtained, and it is assumed that the transmission interval ishjk3=jk3+1h−jk3hStep 2: we judgehjk3≥βh2m?Step 3: if Step 2 is true, the control quantity is corrected and compensated online according to (60); otherwise, Step 4 is directly executedStep 4: the control quantityujk3+1h is output at instant jk3+1hStep 5: we return to Step 1Based on the PID control idea, the following is adopted to correct and compensate the current control quantityujk3+1h in real time:(60)ujk3+1h=ujk3h+kpujk3h−ujk3−1h.Through equation (60), the loss of control quantity caused by DoS attack can be corrected and compensated, so as to realize the active attack tolerance. The specific algorithm of active attack tolerance for high-energy DoS attacks is shown in Table 1.Remark 6.
In equation (60), the first term ujk3h represents the control quantity transmitted successfully at the last time, and the second term kpujk3h−ujk3−1h represents the change of the control quantity successfully transmitted for two consecutive times, where kp is the proportion coefficient. The selection of kp directly affects the state of the control quantity and system performance, so it is necessary to select it reasonably.Remark 7.
Ifhjk3≥βh2m, then the CPS suffers from a high-energy DoS attack, and the lack of control quantity caused by the high-energy attack is updated with the help of the correction compensation algorithm in equation (60) based on the PID idea, so as to achieve active attack tolerance for the high-energy DoS attack. If hjk3<βh2m, then it is a low-energy DoS attack, and the received control quantity will be sent directly to the actuator and act on the controlled plant to passively tolerate attack in a resilient and robust manner. The introduction of security factor β enables a seamless integration of the active and passive attack-tolerance strategy, so as to achieve a more effective defense against limited-energy DoS attacks.


## 5.1. Strategy of Attack Detection and Attack Tolerance

After the maximum allowable time delayh2m is obtained through equation (58), in the process of data transmission, it is assumed that the control quantities ujk3h and ujk3+1h are transmitted to the intelligent execution unit at instant jk3h and jk3+1h, respectively, and set hjk3=jk3+1h−jk3h as the transmission interval of two consecutive received control quantities. In order to ensure that the non-linear CPS has a certain security margin when DoS attack occurs, the security factor β is set, and β∈0,1.Whenhjk3<βh2m, the non-linear CPS is not subject to DoS attack or is subject to a low-energy DoS attack, and it is sufficient to implement a passive attack-tolerance strategy at this time. When hjk3≥βh2m, it is detected that the duration of DoS attack is close to or exceeds the maximum allowed time delay; i.e., this is a high-energy DoS attack intrusion. The passive attack-tolerant strategy can no longer meet the system requirements, and a more targeted active attack-tolerant strategy needs to be adopted. The strategy of DoS attack detection and attack-tolerance is shown in Figure 3.Figure 3
Schematic diagram of the strategy of DoS attack detection and attack-tolerance.


## 5.2. Active Attack-Tolerant Algorithm for DoS Attack

At instantjk3+1h, the latest control quantities stored in the data buffer of the intelligent execution unit are ujk3h and ujk3−1h. Whether the current control quantity ujk3+1h is transmitted or corrected depends on whether a DoS attack is high energy.Oncehjk3≥βh2m, it means that high-energy DoS attack invaded the system, and the current control quantity is blocked from transmission. At this time, if the system can compensate for the lack of control quantity caused by high-energy attack based on the previously stored in the data buffer, then the system can tolerate high-energy DoS attack in an active way.Table 1
Algorithm of DoS attack detection and control quantity compensation.
Step 1: the time interval between two consecutive received control quantities is obtained, and it is assumed that the transmission interval ishjk3=jk3+1h−jk3hStep 2: we judgehjk3≥βh2m?Step 3: if Step 2 is true, the control quantity is corrected and compensated online according to (60); otherwise, Step 4 is directly executedStep 4: the control quantityujk3+1h is output at instant jk3+1hStep 5: we return to Step 1Based on the PID control idea, the following is adopted to correct and compensate the current control quantityujk3+1h in real time:(60)ujk3+1h=ujk3h+kpujk3h−ujk3−1h.Through equation (60), the loss of control quantity caused by DoS attack can be corrected and compensated, so as to realize the active attack tolerance. The specific algorithm of active attack tolerance for high-energy DoS attacks is shown in Table 1.Remark 6.
In equation (60), the first term ujk3h represents the control quantity transmitted successfully at the last time, and the second term kpujk3h−ujk3−1h represents the change of the control quantity successfully transmitted for two consecutive times, where kp is the proportion coefficient. The selection of kp directly affects the state of the control quantity and system performance, so it is necessary to select it reasonably.Remark 7.
Ifhjk3≥βh2m, then the CPS suffers from a high-energy DoS attack, and the lack of control quantity caused by the high-energy attack is updated with the help of the correction compensation algorithm in equation (60) based on the PID idea, so as to achieve active attack tolerance for the high-energy DoS attack. If hjk3<βh2m, then it is a low-energy DoS attack, and the received control quantity will be sent directly to the actuator and act on the controlled plant to passively tolerate attack in a resilient and robust manner. The introduction of security factor β enables a seamless integration of the active and passive attack-tolerance strategy, so as to achieve a more effective defense against limited-energy DoS attacks.


## 6. Simulation Research and Result Analysis

### 6.1. Example Description

A classic quadruple-tank simulation example in [46] is used to verify the effectiveness of the results in this study, where(61)A1=−0.01600.04200−0.01100.03300−0.0420000−0.033,A2=−0.02200.06100−0.01800.04900−0.0640000−0.049,A3=−0.03100.05300−0.02100.06700−0.0830000−0.061,A4=−0.03900.10600−0.027600.082600−0.1070000−0.0827,B1=0.083000.06300.0480.0310,B2=0.1246000.09300.0710.0450,B3=0.165000.12500.0970.0630,B4=0.2076000.157600.130.07760,Eω1=0.010.0100.01,Eω2=0.0160.01600.016,Eω3=0.020.0200.02,Eω4=0.0240.02400.024,Ef1=−0.083000.031T,Ef2=−0.1246000.0464T,Ef3=−0.167000.061T,Ef4=−0.2076000.0774T,C1=diag0.50.50.50.5,C2=diag0.480.480.480.48,C3=diag0.460.460.460.46,C4=diag0.520.520.520.52,Ev1=0.01500.0150.015T,Ev2=0.022400.02240.0224T,Ev3=0.03000.0250.027T,Ev4=0.037400.0310.0326T,(62)ft=0,t≤200,2+2sin0.01πt−100,200<t≤800.The system disturbancewt and noise vik obey the independent white noise process, N0.1,0.01, the initial state is x0=4422T, and the sampling period is h=0.1s. Let n1=0.01,n2=18,n3=0.2,γ1=2.7,α1=0.05, according to Theorem 1, the observer gain matrix Lj and fault estimation gain matrix Fj are obtained as follows:(63)L1=9.51133.5349−4.1339−2.47180.01368.4589−0.0698−0.00591.07663.47784.1001−2.18481.13663.5093−4.73156.5135,L2=9.71614.4964−8.0880−0.00160.01528.4591−0.06010.01701.38954.61082.8128−2.73521.19954.5500−6.74957.0760,L3=10.07535.9208−10.4613−0.11150.03258.3092−0.06550.00211.22454.78892.9127−3.05781.22485.2170−7.57286.7892,(64)L4=8.18334.6009−9.93651.12580.02946.2444−0.07470.02370.73833.57231.8274−1.80310.75863.7818−6.86986.5342,F1=−39.78213.7636172.2936−131.9049,F2=−25.12567.2979184.2543−163.6605,F3=−26.3933−4.4336196.1008−158.0372,F4=−19.6671−2.4067159.5523−131.8709.In Theorem2, we set n1=0.6,n2=2,n3=0.01,γ2=3.2, σs=0.001,α2=0.06,m1=m2=m3=0.2,h2=2.4s, and the matrices Φ and Kj are obtained cooperatively according to Theorem 2.(65)Φ=diag241.9598241.9598241.9598241.9598,K1=−30.384914.5296−24.04291.62409.1219−36.47489.3747−18.1854,K2=−25.180311.5594−18.69891.29647.4759−29.77097.2379−14.4292,K3=−15.55107.3717−12.58991.17944.8103−17.96644.9429−10.0849,K4=−14.00357.1503−11.72261.57424.1782−16.82484.4879−9.6635.Then, the maximum allowable delayh2m=2.592s is obtained through equation (58), and the corresponding maximum number of consecutive packet losses is τMaDoS=5.


### 6.2. Estimations of State and Actuator Fault

In order to make the system stable operation with a certain attack-tolerance security margin, taking the security factorβ=0.9, and combining with hjk3≥βh2m in DoS attack detection algorithm, hjk3=2.33s. According to equation (58), the maximum number of consecutive packet losses within the corresponding security margin is τMDoS=4. If the number of packet losses is greater than the allowed maximum value, i.e., τMDoS=7 and h2m=3.2s, then the DoS attack is of high energy. The sequence of DoS attack is shown in Figure 4, where 0 means no attack and 1 means there is an attack.Figure 4
Sequence of DoS attack.In order to compare the effectiveness of the proposed method, this paper compares it with the passive attack-tolerant strategy using the same deduction process in [13]. For the convenience of subsequent analysis, it is specified that the active-passive attack-tolerant and active fault-tolerant control strategy in this study is dual security control strategy I, and the passive attack-tolerant and active fault-tolerant strategy in [13] is dual security control strategy II. When dual security control strategies I and II are adopted, respectively, the curves of system state estimation errors, continuous time-varying fault estimation, fault estimation error, and system output are obtained, as shown in Figures 5–8.Figure 5
State estimation errors under different attack-tolerance strategies. (a) Dual security control strategy I and (b) dual security control strategy II.
(a)(b)Figure 6
Actuator fault and its estimation under different attack-tolerance strategies. (a) Dual security control strategy I and (b) dual security control strategy II.
(a)(b)Figure 7
Actuator fault estimation error under different attack-tolerance strategies. (a) Dual security control strategy I and (b) dual security control strategy II.
(a)(b)Figure 8
System output response under different attack-tolerance strategies. (a) Dual security control strategy I and (b) dual security control strategy II.
(a)(b)In Figures5(a), 6(a), and 7(a), let kp=1.3, and dual security control strategy I is adopted to deal with high-energy DoS attacks. The system states and actuator fault estimation can remain stable. The reason is that the active-passive attack-tolerant method corrects and compensates the control quantity that cannot be transmitted because the system delay exceeds the maximum allowable value. Therefore, the system defense capability is effectively improved.When dual security control strategy II is adopted, the state estimation errors, continuous time-varying fault estimation, and error are as shown in Figures5(b), 6(b), and 7(b), respectively. It can be seen that the state errors, actuator fault estimation, and error begin to fluctuate after 300 s, and the maximum fluctuation has exceeded ±2. It shows that when the actual time delay is greater than the maximum allowable value, i.e., the system suffers from DoS attack with high energy, dual security control strategy II has been unable to effectively cope with high-energy DoS attack and actuator fault at this time. If the time delay continues to increase, the system fluctuation will further increase and even become unstable.


### 6.3. Analysis of the Trigger Parameter on System Security Performance

Compared with Figures8(a) and 8(b), when dual security control strategy I is adopted, even if the system suffers from high-energy DoS attack and actuator fault, the system output remains stable at about 300 s, while the system begins to fluctuate at 300 s when dual security control strategy II is adopted. In order to collaboratively analyse the dual security and communication resources, the data transmission amount and system security state under different trigger parameters are given in Table 2.Table 2
Data transmission amount and system security state under different trigger parameters.
δsnn¯ (%)h¯ (s)System state0567270.90.141Stable0.0004405950.730.197Stable0.0007364145.510.22Stable0.001316339.540.253Stable0.0013290736.340.275Unstablen is the data transmission amount, n¯ is the data transmission rate, and h¯ is the average data transmission period.On the one hand, with the increase of trigger parameterδs, the amount of data transmission n and the corresponding transmission rate n¯ decrease, and the average transmission period h¯ increases, but the system has become unstable. The continuous increase of δs helps to save network resources, but it is at the expense of system security. Therefore, by balancing the relationship between system security and network resources, the trigger parameter δs=0.001 is finally selected in the study. On the other hand, when the trigger parameter is δs=0, i.e., the periodic time trigger communication scheme is adopted, the transmitted data amount is 5672, while under the DETCS, the data transmission amount is 3163. Obviously, the DETCS greatly reduces the amount of data transmission and effectively saves network resources.


## 6.1. Example Description

A classic quadruple-tank simulation example in [46] is used to verify the effectiveness of the results in this study, where(61)A1=−0.01600.04200−0.01100.03300−0.0420000−0.033,A2=−0.02200.06100−0.01800.04900−0.0640000−0.049,A3=−0.03100.05300−0.02100.06700−0.0830000−0.061,A4=−0.03900.10600−0.027600.082600−0.1070000−0.0827,B1=0.083000.06300.0480.0310,B2=0.1246000.09300.0710.0450,B3=0.165000.12500.0970.0630,B4=0.2076000.157600.130.07760,Eω1=0.010.0100.01,Eω2=0.0160.01600.016,Eω3=0.020.0200.02,Eω4=0.0240.02400.024,Ef1=−0.083000.031T,Ef2=−0.1246000.0464T,Ef3=−0.167000.061T,Ef4=−0.2076000.0774T,C1=diag0.50.50.50.5,C2=diag0.480.480.480.48,C3=diag0.460.460.460.46,C4=diag0.520.520.520.52,Ev1=0.01500.0150.015T,Ev2=0.022400.02240.0224T,Ev3=0.03000.0250.027T,Ev4=0.037400.0310.0326T,(62)ft=0,t≤200,2+2sin0.01πt−100,200<t≤800.The system disturbancewt and noise vik obey the independent white noise process, N0.1,0.01, the initial state is x0=4422T, and the sampling period is h=0.1s. Let n1=0.01,n2=18,n3=0.2,γ1=2.7,α1=0.05, according to Theorem 1, the observer gain matrix Lj and fault estimation gain matrix Fj are obtained as follows:(63)L1=9.51133.5349−4.1339−2.47180.01368.4589−0.0698−0.00591.07663.47784.1001−2.18481.13663.5093−4.73156.5135,L2=9.71614.4964−8.0880−0.00160.01528.4591−0.06010.01701.38954.61082.8128−2.73521.19954.5500−6.74957.0760,L3=10.07535.9208−10.4613−0.11150.03258.3092−0.06550.00211.22454.78892.9127−3.05781.22485.2170−7.57286.7892,(64)L4=8.18334.6009−9.93651.12580.02946.2444−0.07470.02370.73833.57231.8274−1.80310.75863.7818−6.86986.5342,F1=−39.78213.7636172.2936−131.9049,F2=−25.12567.2979184.2543−163.6605,F3=−26.3933−4.4336196.1008−158.0372,F4=−19.6671−2.4067159.5523−131.8709.In Theorem2, we set n1=0.6,n2=2,n3=0.01,γ2=3.2, σs=0.001,α2=0.06,m1=m2=m3=0.2,h2=2.4s, and the matrices Φ and Kj are obtained cooperatively according to Theorem 2.(65)Φ=diag241.9598241.9598241.9598241.9598,K1=−30.384914.5296−24.04291.62409.1219−36.47489.3747−18.1854,K2=−25.180311.5594−18.69891.29647.4759−29.77097.2379−14.4292,K3=−15.55107.3717−12.58991.17944.8103−17.96644.9429−10.0849,K4=−14.00357.1503−11.72261.57424.1782−16.82484.4879−9.6635.Then, the maximum allowable delayh2m=2.592s is obtained through equation (58), and the corresponding maximum number of consecutive packet losses is τMaDoS=5.


## 6.2. Estimations of State and Actuator Fault

In order to make the system stable operation with a certain attack-tolerance security margin, taking the security factorβ=0.9, and combining with hjk3≥βh2m in DoS attack detection algorithm, hjk3=2.33s. According to equation (58), the maximum number of consecutive packet losses within the corresponding security margin is τMDoS=4. If the number of packet losses is greater than the allowed maximum value, i.e., τMDoS=7 and h2m=3.2s, then the DoS attack is of high energy. The sequence of DoS attack is shown in Figure 4, where 0 means no attack and 1 means there is an attack.Figure 4
Sequence of DoS attack.In order to compare the effectiveness of the proposed method, this paper compares it with the passive attack-tolerant strategy using the same deduction process in [13]. For the convenience of subsequent analysis, it is specified that the active-passive attack-tolerant and active fault-tolerant control strategy in this study is dual security control strategy I, and the passive attack-tolerant and active fault-tolerant strategy in [13] is dual security control strategy II. When dual security control strategies I and II are adopted, respectively, the curves of system state estimation errors, continuous time-varying fault estimation, fault estimation error, and system output are obtained, as shown in Figures 5–8.Figure 5
State estimation errors under different attack-tolerance strategies. (a) Dual security control strategy I and (b) dual security control strategy II.
(a)(b)Figure 6
Actuator fault and its estimation under different attack-tolerance strategies. (a) Dual security control strategy I and (b) dual security control strategy II.
(a)(b)Figure 7
Actuator fault estimation error under different attack-tolerance strategies. (a) Dual security control strategy I and (b) dual security control strategy II.
(a)(b)Figure 8
System output response under different attack-tolerance strategies. (a) Dual security control strategy I and (b) dual security control strategy II.
(a)(b)In Figures5(a), 6(a), and 7(a), let kp=1.3, and dual security control strategy I is adopted to deal with high-energy DoS attacks. The system states and actuator fault estimation can remain stable. The reason is that the active-passive attack-tolerant method corrects and compensates the control quantity that cannot be transmitted because the system delay exceeds the maximum allowable value. Therefore, the system defense capability is effectively improved.When dual security control strategy II is adopted, the state estimation errors, continuous time-varying fault estimation, and error are as shown in Figures5(b), 6(b), and 7(b), respectively. It can be seen that the state errors, actuator fault estimation, and error begin to fluctuate after 300 s, and the maximum fluctuation has exceeded ±2. It shows that when the actual time delay is greater than the maximum allowable value, i.e., the system suffers from DoS attack with high energy, dual security control strategy II has been unable to effectively cope with high-energy DoS attack and actuator fault at this time. If the time delay continues to increase, the system fluctuation will further increase and even become unstable.


## 6.3. Analysis of the Trigger Parameter on System Security Performance

Compared with Figures8(a) and 8(b), when dual security control strategy I is adopted, even if the system suffers from high-energy DoS attack and actuator fault, the system output remains stable at about 300 s, while the system begins to fluctuate at 300 s when dual security control strategy II is adopted. In order to collaboratively analyse the dual security and communication resources, the data transmission amount and system security state under different trigger parameters are given in Table 2.Table 2
Data transmission amount and system security state under different trigger parameters.
δsnn¯ (%)h¯ (s)System state0567270.90.141Stable0.0004405950.730.197Stable0.0007364145.510.22Stable0.001316339.540.253Stable0.0013290736.340.275Unstablen is the data transmission amount, n¯ is the data transmission rate, and h¯ is the average data transmission period.On the one hand, with the increase of trigger parameterδs, the amount of data transmission n and the corresponding transmission rate n¯ decrease, and the average transmission period h¯ increases, but the system has become unstable. The continuous increase of δs helps to save network resources, but it is at the expense of system security. Therefore, by balancing the relationship between system security and network resources, the trigger parameter δs=0.001 is finally selected in the study. On the other hand, when the trigger parameter is δs=0, i.e., the periodic time trigger communication scheme is adopted, the transmitted data amount is 5672, while under the DETCS, the data transmission amount is 3163. Obviously, the DETCS greatly reduces the amount of data transmission and effectively saves network resources.


## 7. Conclusions

A codesign of dual security control and communication for a non-linear CPS with actuator fault and DoS attack under the DETCS is studied, and the effectiveness of the proposed method is verified by a practical engineering case of a quadruple-tank system. The conclusions are as follows:(1)
In order to effectively distinguish DoS attacks with different energy levels, an attack detection method is designed based on the maximum allowable delay. In addition, an active attack-tolerant strategy is proposed based on the PID idea for the lack of control quantity caused by high-energy DoS attack, which can effectively defend against high-energy DoS attack.(2)
Under multi-objective constraints, the design methods of an observer for state and fault and a controller with passive attack tolerance and active fault tolerance are given, respectively, which can effectively tolerate DoS attack with low energy and actuator fault. The methods can not only effectively save network resources but also have better dynamic performance, so as to improve the dual security control capability of the system.(3)
The active-passive attack-tolerance strategy expands the defense range of DoS attacks, and the introduction of security factor makes the intersection between active and passive attack tolerance, and it further improves the security degree of system attack tolerance.In this study, the classical discrete event-triggered communication scheme is used, and although the network resources have been saved, the security and communication performance still need to be further optimized. In the future, more effective research on attack tolerance, fault tolerance, and communication resource saving will be carried out based on the adaptive event-triggered scheme. In addition, it is challenging to apply machine learning algorithms to effectively reconstruct and compensate for the data loss caused by DoS attacks.



---

*Source: 1734593-2022-02-18.xml*