# Optimal Jamming Attack Scheduling in Networked Sensing and Control Systems

Authors: Lifu Zhang; Heng Zhang; Cunhua Li; Buxi Ni
Journal: International Journal of Distributed Sensor Networks
 (2015)

---

## Abstract

This paper investigates the optimal jamming attack scheduling in Networked Sensing and Control
Systems (NSCS). From viewpoint of the attacker, we formulate an optimization problem which
maximizes the Linear Quadratic Gaussian (LQG) control cost with attacking energy constraint in a
finite time horizon. For two special cases, we obtain that the optimal jamming attack schedule is to
consecutively attack in the given time horizon. For the general case, we propose an algorithm to find the
optimal schedules. Finally, we study the effectiveness of our proposed attack strategies on our established
semiphysical testbed.


---

## Body

## 1. Introduction

Networked Sensing and Control Systems (NSCS) are control systems wherein physical elements, that is, plants, sensors, controllers, and actuators, are connected via wireless communication networks. NSCS have a wide range of applications in factory automation, unmanned aerial vehicles, remote surgery, intelligent transportation, smart grid, smart building, and so forth [1–5]. The essential characteristic of NSCS is that the physical elements and cyberspace are tightly integrated to carry out various jobs [6–8]. However, NSCS are vulnerable to an increasing number of malicious cyber attacks [9]. For example, an Iranian nuclear facility was attacked by “stuxnet” in 2010 and cannot operate normally in a long time since more than 60% of centrifugal control systems were destroyed [10].In the past few years, several literatures have been focused on evaluating the effect of cyber attacks, for example, Denial-of-Service (DoS) attacks [11, 12], replay attacks [13, 14], and false data injection attacks [15, 16], on NSCS. Among these attacks, DoS attack is the most accomplishable one and can result in serious consequences [11]. Thus, it has been widely studied recently. In order to block the communication between system elements, DoS attacker can interfere with the radio frequencies on the communication channels [17]. In fact, jamming is a typical mode of DoS attack [18].LQG control cost, which is used to synthetically consider the cost of system states and control, is an important performance in NSCS. Some researches have put emphasis on the security of LQG control under jamming attack [11, 19, 20]. Amin et al. study the optimal controller which minimize the LQG cost with safety and energy constraints when a jamming attacker takes identical independent distributed jamming actions [11]. They present semidefinite programming to solve this problem. Gupta et al. design an optimal controller to defense the intelligent jamming attack with limited actions [19]. Shisheh Foroush and Martinez propose an event-trigger control law which can prevent the periodic jamming attack with energy constraint [20]. The commonality of these works is that they all focus on the design of defense strategies under given attack patterns. However, our work stands in the viewpoint of attacker and finds the optimal attack schedules to maximize the control performance. This is of equal importance as one can provide effective defensive policies only when he grasps the attack strategies.The goal of this paper is to design an optimal offline jamming schedule, which can maximize the attack effect on the NSCS. Specifically, in our scenario, one sensor observes the states of plant and sends the measurements to a remote estimator via a wireless channel. The attacker has a limited energy budget in the given finite time horizon. He has to decide whether or not to jam the channel from sensor to estimator at each time. The main contributions of this paper which distinguish it from the related literatures are summarized as follows:(1)
We formulate a jamming attack scheduling problem and look for the optimal jamming schedule that maximizes the LQG cost with energy constraint in a given finite time horizon.(2)
We present the close form of the optimal jamming schedule for two special cases and provide an algorithm to search the optimal schedules for the general case.(3)
We study the effectiveness of proposed jamming schedules on the established semiphysical testbed.The remainder of the paper is organized as follows. In Section2, we formulate the problem. In Section 3, we study the system performance under given attack schedule. In Section 4, we present the optimal jamming attack schedules for special cases and provide an algorithm to search the optimal attack schedules for the general case. In Section 5, we demonstrate the effectiveness of proposed optimal jamming schedules on the semiphysical testbed. Finally, Section 6 concludes the paper.Notations. E[X] is the mean of random variable X, and EX∣Y is the mean of random variable X conditioned on Y, respectively. tr⁡(·) represents the trace of matrix. X⪯Y means that Y-X is nonnegative-definite; that is, Y-X⪰0.


## 2. Problem Formulation

### 2.1. System Architecture

Consider the following linear time-invariant system (Figure1):(1)xt+1=Axt+ut+wt,yt=Cxt+vt,where xt∈Rnx is the state of plant at time t, yt∈Rny is the measurement from sensor, and wt and vt are uncorrelated zero mean Gaussian white noises with covariance Σw and Σv, respectively. The pair (A,C) is assumed to be observable and (A,Σw1/2) is controllable.Figure 1
System architecture.In our scenario, the sensor observes the plant and gets the measurementsyt. According to these measurements, it preestimates the state xt and obtains the minimum mean squared error (MMSE) estimate; that is, x^ts=Ext∣y1,…,yt. Then the sensor sends these estimates to a remote estimator through a wireless channel. The controller then generates a control packet ut based on the received estimates and sends the control packet to the actuator through another dependable channel.Letθt be the indicator function whether the packet x^ts is received or not by the estimator; that is, (2)θt=1,ifx^tsis received by the estimator;0,otherwise.DenoteDt by all the data received by estimator until time t; that is, (3)Dt=θ1,θ2,…,θt,θ1x^1s,θ2x^2s,…,θtx^ts.Letx^t be the minimum mean square error (MMSE) estimate in the estimator at time t; that is, (4)x^t=Ext∣Dt. The corresponding error covariance is (5)Pt=Ext-x^txt-x^t′∣Dt.Similar to [21], we have(6)x^t=x^ts,ifθt=1;Ax^t-1s+But-1,otherwise.In order to minimize the LQG cost function(7)J=∑t=0T-1Ext′Qxt+ut′Rut+xT′QxT in the finite time horizon [1,T], where Q⪰0 and R≻0 are two weighting matrices and the expectation is taken over {wk}, we exploit a linear static feedback controller of the form uk=Lx^k. It is assumed that the system is unaware of the existence of attacker.


### 2.2.  Attack Model

In our scenario, there is an attacker who wishes to deteriorate the control performance by jamming the sensor-to-estimator wireless channel. It is assumed that the attacker has a limited energy budget; that is, he can attackn times at most in the time horizon [1,T] [22]. The attacker has to decide whether to attack or not at each sampling time in order to achieve his aim. Let γt be the attack decision variable at time t; that is,(8)γt=1,if attacker jams the wireless channel;0,otherwise. Similar to [18], we assume that the attack action is successful with probability α, and packet drop variables under attack are independent.Specifically, from the viewpoint of attacker, he aims to maximize the cost function with energy constraint which is as follows.Problem 1.
Consider(9)maxγ∈ΘEJγs.t.∑t=1Tγt≤n,where γ=(γ1,γ2,…,γT) is the attack schedule on the finite time horizon [1,T] and Θ=γ∣γt∈0,1,t=1,2,…,T is the attack schedule space.


## 2.1. System Architecture

Consider the following linear time-invariant system (Figure1):(1)xt+1=Axt+ut+wt,yt=Cxt+vt,where xt∈Rnx is the state of plant at time t, yt∈Rny is the measurement from sensor, and wt and vt are uncorrelated zero mean Gaussian white noises with covariance Σw and Σv, respectively. The pair (A,C) is assumed to be observable and (A,Σw1/2) is controllable.Figure 1
System architecture.In our scenario, the sensor observes the plant and gets the measurementsyt. According to these measurements, it preestimates the state xt and obtains the minimum mean squared error (MMSE) estimate; that is, x^ts=Ext∣y1,…,yt. Then the sensor sends these estimates to a remote estimator through a wireless channel. The controller then generates a control packet ut based on the received estimates and sends the control packet to the actuator through another dependable channel.Letθt be the indicator function whether the packet x^ts is received or not by the estimator; that is, (2)θt=1,ifx^tsis received by the estimator;0,otherwise.DenoteDt by all the data received by estimator until time t; that is, (3)Dt=θ1,θ2,…,θt,θ1x^1s,θ2x^2s,…,θtx^ts.Letx^t be the minimum mean square error (MMSE) estimate in the estimator at time t; that is, (4)x^t=Ext∣Dt. The corresponding error covariance is (5)Pt=Ext-x^txt-x^t′∣Dt.Similar to [21], we have(6)x^t=x^ts,ifθt=1;Ax^t-1s+But-1,otherwise.In order to minimize the LQG cost function(7)J=∑t=0T-1Ext′Qxt+ut′Rut+xT′QxT in the finite time horizon [1,T], where Q⪰0 and R≻0 are two weighting matrices and the expectation is taken over {wk}, we exploit a linear static feedback controller of the form uk=Lx^k. It is assumed that the system is unaware of the existence of attacker.


## 2.2.  Attack Model

In our scenario, there is an attacker who wishes to deteriorate the control performance by jamming the sensor-to-estimator wireless channel. It is assumed that the attacker has a limited energy budget; that is, he can attackn times at most in the time horizon [1,T] [22]. The attacker has to decide whether to attack or not at each sampling time in order to achieve his aim. Let γt be the attack decision variable at time t; that is,(8)γt=1,if attacker jams the wireless channel;0,otherwise. Similar to [18], we assume that the attack action is successful with probability α, and packet drop variables under attack are independent.Specifically, from the viewpoint of attacker, he aims to maximize the cost function with energy constraint which is as follows.Problem 1.
Consider(9)maxγ∈ΘEJγs.t.∑t=1Tγt≤n,where γ=(γ1,γ2,…,γT) is the attack schedule on the finite time horizon [1,T] and Θ=γ∣γt∈0,1,t=1,2,…,T is the attack schedule space.


## 3. Preliminaries

In this section, we present some properties of the estimate at the estimator side and the control performance of plant under a jamming attack.


### 3.1. State Estimation under Jamming Attack

From standard Kalman filter, the estimate and corresponding error covariance at the sensor side can be calculated as follows:(10)x^t∣t-1s=Ax^t-1s+ut-1,Pt∣t-1s=APt-1sA′+Σw,Kts=Pt∣t-1sC′CPt∣t-1sC′+Σv-1,x^ts=Ax^t-1s+Ktsyt-Cx^t∣t-1s,Pts=I-KtsCPt∣t-1s, where the initial state is x^0=0, and P0s=Π0. From [23], we can see that the error covariance Pts converges exponentially to its steady-state value P¯. Thus, we assume that Π0=P¯. It can be seen that Pts=P¯ for all t∈[1,T].Define functionsh,ht as h(X)≜AXA′+Σw and ht(X)≜h∘h∘⋯∘h︸ttimes(X).From [23], the following result holds.Lemma 2.
The functionh has the following property: (11)P¯⪯hP¯⪯h2P¯⪯⋯⪯htP¯⪯⋯,∀t∈Z+.From [22], we can obtain the estimate x^t and error covariance Pt at estimator side as follows:(12)x^t,Pt=Ax^t-1+ut-1,hPt-1,ifγt=1,θt=1,x^ts,P¯,otherwise.Define attack sequence(k1,k2,…,ks) as the attack schedules which has the following form: (13)0,…,0,1,…,1︸k1times,0,…,0,1,…,1︸k2times,0,…,0,1,…,1︸kstimes,0,…,0.Similar to [18, 22], one can get the following result.Lemma 3.
LetE(k1⊗k2⊗⋯⊗ks) be the average expected error covariance in time horizon [1,T] under attack sequence (k1,k2,…,ks) at estimator side, and let E(k) be the average expected error covariance under attack sequence (k). The following statements are true: (1)
E(k1)⪯E(k2), where k1<k2.(2)
E(k1⊗k2⊗⋯⊗ks)⪯E(k), where k=k1+k2+⋯+ks.(3)
E(k1⊗k2)⪯E(l1⊗l2), where k1+k2=l1+l2 and max{k1,k2,l1,l2} is l1 or l2.From Lemma3, we can see that grouping together as much as possible can lead to maximal average error covariance.


### 3.2. Control Performance under Jamming Attack

In order to find the optimal offline jamming attack scheduling, we have to study the control performance when the attack schedule is given.According to [5, 24], one can obtain the following result.Lemma 4.
The LQG control cost function under a given attack scheduleγ can be calculated as follows:(14)Jγ=tr⁡S0P0+∑t=0T-1tr⁡St+1Σw+∑t=0T-1tr⁡A′St+1A+Q-StEγPt,where St can be computed from the following recursive equation:(15)St=A′St+1A+Q-A′St+1St+1+R-1St+1A,t=0,1,…,T-1.In fact, (15) converges quickly to a steady state. Thus, if T→∞, one can see that(16)S=A′SA+Q-A′SS+R-1SA,where S=limT→∞ST. In practice, we often choose ut=Lx^t with control gain L=-(S+R)-1SA as the optimal static state feedback controller to maximize the cost J∞=limT→∞J. In our scenario, we assume that the system has reached steady state; that is, S0=S, and P0=P¯. Then (14) can be rewritten as(17)Jγ=Jc+Je,where(18)Jc=tr⁡SP¯+N·tr⁡SΣw,Je=∑t=0T-1tr⁡A′SA+Q-SEγPt.It can be seen thatJc and Je are the constant part and varying part of (17), respectively. Thus, we only have to study the optimal jamming attack schedule which maximizes Je which is as follows.Problem 5.
Consider(19)max⁡γ∈ΘEJeγs.t.∑t=1Tγt≤n.


## 3.1. State Estimation under Jamming Attack

From standard Kalman filter, the estimate and corresponding error covariance at the sensor side can be calculated as follows:(10)x^t∣t-1s=Ax^t-1s+ut-1,Pt∣t-1s=APt-1sA′+Σw,Kts=Pt∣t-1sC′CPt∣t-1sC′+Σv-1,x^ts=Ax^t-1s+Ktsyt-Cx^t∣t-1s,Pts=I-KtsCPt∣t-1s, where the initial state is x^0=0, and P0s=Π0. From [23], we can see that the error covariance Pts converges exponentially to its steady-state value P¯. Thus, we assume that Π0=P¯. It can be seen that Pts=P¯ for all t∈[1,T].Define functionsh,ht as h(X)≜AXA′+Σw and ht(X)≜h∘h∘⋯∘h︸ttimes(X).From [23], the following result holds.Lemma 2.
The functionh has the following property: (11)P¯⪯hP¯⪯h2P¯⪯⋯⪯htP¯⪯⋯,∀t∈Z+.From [22], we can obtain the estimate x^t and error covariance Pt at estimator side as follows:(12)x^t,Pt=Ax^t-1+ut-1,hPt-1,ifγt=1,θt=1,x^ts,P¯,otherwise.Define attack sequence(k1,k2,…,ks) as the attack schedules which has the following form: (13)0,…,0,1,…,1︸k1times,0,…,0,1,…,1︸k2times,0,…,0,1,…,1︸kstimes,0,…,0.Similar to [18, 22], one can get the following result.Lemma 3.
LetE(k1⊗k2⊗⋯⊗ks) be the average expected error covariance in time horizon [1,T] under attack sequence (k1,k2,…,ks) at estimator side, and let E(k) be the average expected error covariance under attack sequence (k). The following statements are true: (1)
E(k1)⪯E(k2), where k1<k2.(2)
E(k1⊗k2⊗⋯⊗ks)⪯E(k), where k=k1+k2+⋯+ks.(3)
E(k1⊗k2)⪯E(l1⊗l2), where k1+k2=l1+l2 and max{k1,k2,l1,l2} is l1 or l2.From Lemma3, we can see that grouping together as much as possible can lead to maximal average error covariance.


## 3.2. Control Performance under Jamming Attack

In order to find the optimal offline jamming attack scheduling, we have to study the control performance when the attack schedule is given.According to [5, 24], one can obtain the following result.Lemma 4.
The LQG control cost function under a given attack scheduleγ can be calculated as follows:(14)Jγ=tr⁡S0P0+∑t=0T-1tr⁡St+1Σw+∑t=0T-1tr⁡A′St+1A+Q-StEγPt,where St can be computed from the following recursive equation:(15)St=A′St+1A+Q-A′St+1St+1+R-1St+1A,t=0,1,…,T-1.In fact, (15) converges quickly to a steady state. Thus, if T→∞, one can see that(16)S=A′SA+Q-A′SS+R-1SA,where S=limT→∞ST. In practice, we often choose ut=Lx^t with control gain L=-(S+R)-1SA as the optimal static state feedback controller to maximize the cost J∞=limT→∞J. In our scenario, we assume that the system has reached steady state; that is, S0=S, and P0=P¯. Then (14) can be rewritten as(17)Jγ=Jc+Je,where(18)Jc=tr⁡SP¯+N·tr⁡SΣw,Je=∑t=0T-1tr⁡A′SA+Q-SEγPt.It can be seen thatJc and Je are the constant part and varying part of (17), respectively. Thus, we only have to study the optimal jamming attack schedule which maximizes Je which is as follows.Problem 5.
Consider(19)max⁡γ∈ΘEJeγs.t.∑t=1Tγt≤n.


## 4. Optimal Jamming Attack Schedules

In this section, we firstly study the jamming schedules against LQG control for two special cases and present the close form of optimal schedules. Then we investigate the attack strategies for the general case.


### 4.1. Case I:R=0

WhenR=0, it can be seen that the LQG cost function becomes (20)J=∑t=0TExt′Qxt.From Lemma4, we can obtain the following conclusion.Theorem 6.
IfR=0, the optimal state feedback controller is ut=Lx^t=-Ax^t, and the corresponding LQG cost function under attack schedule γ is (21)J=Jc+Je, where (22)Jc=tr⁡QP¯+N·tr⁡QΣw,Je=∑t=0T-1tr⁡A′QAEγPt.According to Theorem6, we can see that the attacker only needs to maximize E[Je]. Since A′QA⪰0, one can obtain that maxγE[Je] is equivalent to maxγE[∑t=0N-1Pt(γ)]. Thus, from viewpoint of attacker, we only have to solve the following problem.Problem 7.
Consider(23)max⁡γ∈ΘE∑t=0N-1Ptγs.t.∑t=1Tγt≤n.From [18, 22], Problem 7 can be easily solved by the following theorem.Theorem 8.
WhenR=0, the optimal attack schedules are any consecutive attack n times in time horizon [1,T], and the corresponding expected LQG cost function is (24)EJ=Jc+Jemax⁡, where (25)Jemax⁡=∑i=1Ttr⁡giP¯+T-nαtr⁡MP¯, with M=A′QA and gi(P¯)=Mhi(P¯).


### 4.2. Case II:S0=S

DefineM¯=A′SA+Q-S, and g¯i(P¯)=M¯hi(P¯), i=1,2,…. Then we have following lemma.Lemma 9.
The functiong¯ has the following property: (26)g¯1P¯⪯g¯2P¯⪯⋯⪯g¯iP¯⪯⋯.According to Section3.2, the objective of Problem 1 is equivalent to maxγE[∑t=0N-1Pt(γ)]. Thus, from the viewpoint of attacker, we only have to solve Problem 7 for the case S0=S.From Lemma9 and Theorem  3.1 in [22], we can solve this problem by the following theorem.Theorem 10.
WhenS0=S, the optimal attack schedules are any consecutive attack n times in time horizon [1,T], and the corresponding expected LQG cost function is (27)EJ=Jc+Jemax⁡, where (28)Jemax⁡=∑i=1Ttr⁡g¯iP¯+T-nαtr⁡M¯·P¯.


### 4.3. General Case Study

For the general case, it is difficult to obtain a close form of optimal attack schedule. Attacker can find the optimal jamming schedule by exhaustion method which is given in Algorithm1. Since this schedule can be computed before the attack action begins, the computation of our proposed algorithm will not cost too much.Algorithm 1:Optimal offline attack schedule.
(1) Process begins;
(2)   Input:Htime=T; Π0=P¯; J∗=0;
(3)forγ1+γ2+⋯+γT=ndo
(4)  Compute LQG cost (14) under attack schedule γ, that is J=J(γ)
(5)ifJ>J∗then
(6) J∗=J, and γ∗=(γ1,γ2,…,γT)
(7)end if
(8)end for
(9)   Output: optimal attack scheduleγ∗, and corresponding cost J∗.


## 4.1. Case I:R=0

WhenR=0, it can be seen that the LQG cost function becomes (20)J=∑t=0TExt′Qxt.From Lemma4, we can obtain the following conclusion.Theorem 6.
IfR=0, the optimal state feedback controller is ut=Lx^t=-Ax^t, and the corresponding LQG cost function under attack schedule γ is (21)J=Jc+Je, where (22)Jc=tr⁡QP¯+N·tr⁡QΣw,Je=∑t=0T-1tr⁡A′QAEγPt.According to Theorem6, we can see that the attacker only needs to maximize E[Je]. Since A′QA⪰0, one can obtain that maxγE[Je] is equivalent to maxγE[∑t=0N-1Pt(γ)]. Thus, from viewpoint of attacker, we only have to solve the following problem.Problem 7.
Consider(23)max⁡γ∈ΘE∑t=0N-1Ptγs.t.∑t=1Tγt≤n.From [18, 22], Problem 7 can be easily solved by the following theorem.Theorem 8.
WhenR=0, the optimal attack schedules are any consecutive attack n times in time horizon [1,T], and the corresponding expected LQG cost function is (24)EJ=Jc+Jemax⁡, where (25)Jemax⁡=∑i=1Ttr⁡giP¯+T-nαtr⁡MP¯, with M=A′QA and gi(P¯)=Mhi(P¯).


## 4.2. Case II:S0=S

DefineM¯=A′SA+Q-S, and g¯i(P¯)=M¯hi(P¯), i=1,2,…. Then we have following lemma.Lemma 9.
The functiong¯ has the following property: (26)g¯1P¯⪯g¯2P¯⪯⋯⪯g¯iP¯⪯⋯.According to Section3.2, the objective of Problem 1 is equivalent to maxγE[∑t=0N-1Pt(γ)]. Thus, from the viewpoint of attacker, we only have to solve Problem 7 for the case S0=S.From Lemma9 and Theorem  3.1 in [22], we can solve this problem by the following theorem.Theorem 10.
WhenS0=S, the optimal attack schedules are any consecutive attack n times in time horizon [1,T], and the corresponding expected LQG cost function is (27)EJ=Jc+Jemax⁡, where (28)Jemax⁡=∑i=1Ttr⁡g¯iP¯+T-nαtr⁡M¯·P¯.


## 4.3. General Case Study

For the general case, it is difficult to obtain a close form of optimal attack schedule. Attacker can find the optimal jamming schedule by exhaustion method which is given in Algorithm1. Since this schedule can be computed before the attack action begins, the computation of our proposed algorithm will not cost too much.Algorithm 1:Optimal offline attack schedule.
(1) Process begins;
(2)   Input:Htime=T; Π0=P¯; J∗=0;
(3)forγ1+γ2+⋯+γT=ndo
(4)  Compute LQG cost (14) under attack schedule γ, that is J=J(γ)
(5)ifJ>J∗then
(6) J∗=J, and γ∗=(γ1,γ2,…,γT)
(7)end if
(8)end for
(9)   Output: optimal attack scheduleγ∗, and corresponding cost J∗.


## 5. Simulation

### 5.1. Testbed

There are three types testbeds for simulation of NSCS security, that is, software simulation testbeds, physical simulation testbeds, and semiphysical simulation testbeds. The software simulation testbeds cannot fully simulate the real environment. The physical simulation testbeds can employ the same experimental equipment with the real world to construct the security test platform. However, they need long cycle of construction and great cost. Fortunately, semiphysical simulation testbeds are the good choice for NSCS security since they can simulate the real working environment and save the cost. Thus, we choose a semiphysical simulation testbed to study the effectiveness of our proposed attack strategy.Our semiphysical simulation testbed is composed of virtual plant, physical controller, and communication network. Figure2 shows the system architecture. In our testbed, real-time system states of the virtual plant are sent to the PLC through a wireless network. After reading the system states, the controller calculates the control data and writes them back to the PLC. Then the control data are sent back to the virtual plant via a wired channel.Figure 2
The structure of semiphysical testbed.
(a)
The physical structure
(b)
The schematic diagramWe build an inverted pendulum control system for experiments, which is based on the system presented in [5]. The parameters are given as follows: (29)A=1.0010.0050.0000.0000.3501.001-0.1350.000-0.0010.0001.0010.005-0.375-0.0010.5901.001,B=0.0010.540-0.002-1.066,Σw=qq′,q=0.0031.000-0.005-2.150,Q=5000010000100001.We employ USRP N210 to simulate jamming attack on the wireless channel from sensor to controller. USRP is a universal software radio peripheral that can send and receive radio signal. We use the software GNU Radio in Ubuntu to manipulate the USRP. The frequency spectrum analyzer is adopted to detect the central frequency and waveform of transmission signals. Then we adapt the parameters on GNU Radio to configure the USRP. Experimental parameters are set as follows: center frequency is 433 MHz; waveform is saw tooth; jamming power is 16 dB and jamming signal frequency is 10k; bandwidth is 20 MHz.We verify the proposed optimal offline attack strategies through experiments based on the semiphysical testbed. We setT=250 and the attack times n=10 in the finite time horizon [1,250]. It means that the attacker can assign the 10 times of attack in this period.


### 5.2. Simulation Results Analysis

We study the effectiveness of jamming attack with 10 different schedules whenR=0, S0=S, respectively (see Table 1). From Figure 3(a), we can compare the cost J under different attack schedules when R=0. It can be seen that the attack schedule with 10 consecutive attack times can maximize the LQG cost. We also present the variation of system states and control data under optimal attack schedule in Figure 4. From this figure, these data will deviate the equilibrium points when the wireless channel is under jamming attack. Similarly, we can also study the LQG cost J under different attack schedules when S0=S. From Figure 3(b), we also can see that consecutive attack schedule is optimal. These experimental results can verify the theoretical conclusions in Section 4.Table 1
Attack schedules in our experiment.
Mark number
1
2
3
4
5
Attack sequence
No attack
(
1,2
,
3,4
)
(
6,3
,
1
)
(
4,4
,
2
)
(
5,5
)
Mark number
6
7
8
9
10
Attack sequence
(
4,6
)
(
7,3
)
(
8,2
)
(
9,1
)
(10)Figure 3
Compare the costJ under different attack strategies. The lateral axis is the mark number of attack strategy. Attack strategy 10 is the consecutive attack strategy.
(a)
R
=
0
(b)
S
0
=
SFigure 4
The variation of system states and control data under attack schedule 10 (optimal attack) whenR=0.


## 5.1. Testbed

There are three types testbeds for simulation of NSCS security, that is, software simulation testbeds, physical simulation testbeds, and semiphysical simulation testbeds. The software simulation testbeds cannot fully simulate the real environment. The physical simulation testbeds can employ the same experimental equipment with the real world to construct the security test platform. However, they need long cycle of construction and great cost. Fortunately, semiphysical simulation testbeds are the good choice for NSCS security since they can simulate the real working environment and save the cost. Thus, we choose a semiphysical simulation testbed to study the effectiveness of our proposed attack strategy.Our semiphysical simulation testbed is composed of virtual plant, physical controller, and communication network. Figure2 shows the system architecture. In our testbed, real-time system states of the virtual plant are sent to the PLC through a wireless network. After reading the system states, the controller calculates the control data and writes them back to the PLC. Then the control data are sent back to the virtual plant via a wired channel.Figure 2
The structure of semiphysical testbed.
(a)
The physical structure
(b)
The schematic diagramWe build an inverted pendulum control system for experiments, which is based on the system presented in [5]. The parameters are given as follows: (29)A=1.0010.0050.0000.0000.3501.001-0.1350.000-0.0010.0001.0010.005-0.375-0.0010.5901.001,B=0.0010.540-0.002-1.066,Σw=qq′,q=0.0031.000-0.005-2.150,Q=5000010000100001.We employ USRP N210 to simulate jamming attack on the wireless channel from sensor to controller. USRP is a universal software radio peripheral that can send and receive radio signal. We use the software GNU Radio in Ubuntu to manipulate the USRP. The frequency spectrum analyzer is adopted to detect the central frequency and waveform of transmission signals. Then we adapt the parameters on GNU Radio to configure the USRP. Experimental parameters are set as follows: center frequency is 433 MHz; waveform is saw tooth; jamming power is 16 dB and jamming signal frequency is 10k; bandwidth is 20 MHz.We verify the proposed optimal offline attack strategies through experiments based on the semiphysical testbed. We setT=250 and the attack times n=10 in the finite time horizon [1,250]. It means that the attacker can assign the 10 times of attack in this period.


## 5.2. Simulation Results Analysis

We study the effectiveness of jamming attack with 10 different schedules whenR=0, S0=S, respectively (see Table 1). From Figure 3(a), we can compare the cost J under different attack schedules when R=0. It can be seen that the attack schedule with 10 consecutive attack times can maximize the LQG cost. We also present the variation of system states and control data under optimal attack schedule in Figure 4. From this figure, these data will deviate the equilibrium points when the wireless channel is under jamming attack. Similarly, we can also study the LQG cost J under different attack schedules when S0=S. From Figure 3(b), we also can see that consecutive attack schedule is optimal. These experimental results can verify the theoretical conclusions in Section 4.Table 1
Attack schedules in our experiment.
Mark number
1
2
3
4
5
Attack sequence
No attack
(
1,2
,
3,4
)
(
6,3
,
1
)
(
4,4
,
2
)
(
5,5
)
Mark number
6
7
8
9
10
Attack sequence
(
4,6
)
(
7,3
)
(
8,2
)
(
9,1
)
(10)Figure 3
Compare the costJ under different attack strategies. The lateral axis is the mark number of attack strategy. Attack strategy 10 is the consecutive attack strategy.
(a)
R
=
0
(b)
S
0
=
SFigure 4
The variation of system states and control data under attack schedule 10 (optimal attack) whenR=0.


## 6. Conclusion

In this paper, we considered the optimal jamming attack scheduling which can destroy the system control performance. We formulated an optimization problem that maximizes the LQG cost subject to attacker’s energy constraint in a given finite time horizon. Optimal attack schedule has been presented for two special cases. For the general case, we provided an algorithm to find the optimal attack schedule. We also established a semiphysical testbed and studied the effectiveness of proposed attack schedules by simulation. In the future, we will study the evaluation of control performance when the NSCS is under other types of cyber attack, for example, data injection attack and replay attack. We will also design effective defense strategies to avoid the cyber attacks in NSCS.



---

*Source: 206954-2015-10-08.xml*