# Secure Event-Triggered Mechanism for Networked Control Systems under Injection Cyber-Attacks

Authors: Xiao Cai; Jian Kang; Kaibo Shi
Journal: Discrete Dynamics in Nature and Society
 (2022)

---

## Abstract

This study focuses on the secure stability issue of networked control systems (NCSs) under injection cyber-attacks (ICAs), which have important research value of applications for network security. Firstly, a more general Lyapunov–Krasovskii functional (LKF) is constructed based on the time-delay phenomenon in systems. Secondly, a novel boundary looped function (BLF) is developed depending on the sampling period, fully considering delay and sampling information, and the initial constraints of the criteria on the matrices are effectively relaxed. In addition, appropriate integral inequalities are used, making the obtained criteria less conservative in this paper. Then, a new event-trigger mechanism (ETM) controller under ICAs is designed to control the asymptotical stability (AS) of NCSs. Finally, a numerical experiment verifies the correctness and feasibility of the theory.


---

## Body

## 1. Introduction

As one of the greatest inventions in the 21st century, the popularity of the Internet has brought significant changes and influences on people’s production and lives. With the further development of the Internet, the emergence of big data better reflects the advantages of the Internet. Better handling of big data and better transmission of data have become a hot direction for future research [1, 2]. Data transmission is ultimately reflected in network communication applications (see Figure 1). Thus, network communication technology has been widely used in industrial and military fields. It is a current trend to add components of control systems to these applications through the Internet [3–5].Figure 1
Internet communication topology.However, in control theory, signal transmission usually relies on network communication techniques. Therefore, this brings the control system into contact with the Internet [6, 7]. Signal transmission between the components of NCSs can be carried out through the network. When we design and implement the corresponding control system, we can reduce the influence of the signal transmission between the components of NCSs through the network [8]. This approach allows NCSs to reduce their complexity and overall cost-effectiveness. Unnecessary wiring between components is eliminated, which effectively reduces the NCS complexity and overall cost. Therefore, NCSs have become one of the hot issues of current research [9, 10]. In [8], Zhang proposed a novel robust event-triggered fault-tolerant automatic steering control strategy for autonomous land vehicles to achieve path tracking and vehicle lateral motion control under in-vehicle network delay. In [9], the problem of fault-tolerant sampled-data control for an NCS with random time delays and actuator faults was investigated. In [10], the authors studied the application of NCSs to high-speed trains.On the one hand, the data on the NCS can be effectively shared, which facilitates the fusion of all the information in an ample actual physical space. This way, if the system needs to be upgraded or changed, sensors, controllers, and actuators will need to be added or removed without significant changes to the system architecture [11]. Most importantly, connecting cyber-space to physical space makes real-time control feasible. Therefore, this makes the NCSs gradually tend to control artificial intelligence and the arrival of the era when everything is connected [12]. On the other hand, the transmission of signals in the communication process of the network is not always secure. Normal loss or delay of signals in network communications is a common phenomenon. We think this phenomenon is acceptable and can be controlled. There has been a malicious attack or sabotage of communication equipment or control systems. We believe this behavior is a cyber-attack, and the person that launched the cyber-attack is a hacker [13]. At present, common cyber-attacks are mainly divided into the following categories: random cyber-attacks [14–16], deception cyber-attacks [17–19], jamming attacks [20, 21], and DoS attacks [22–24]. Thus, effectively countering and defending against hacker attacks is also one of the hot topics. In [15], Liu focused on the controller design problem of NCSs, and a hybrid-triggering communication strategy was employed to save the limited communication resources. In [18], the authors investigated the H∞ memory sample-data control issue of the T-S fuzzy NCSs with multiple asynchronous deception attacks. In [21], the event-based controller synthesis problem of NCSs under resilient event-triggering communication schemes and periodic DoS jamming attacks was studied. In [24], Feng aimed to explore the tradeoffs between system resilience and network bandwidth capacity.Based on the above discussion, this paper mainly studies the security issues of NCSs. When hackers attack the system, the ETM controller we designed can effectively ensure the stability of the system. Compared with existing works [25–27], the main contributions of this paper are as follows:(1)
According to the advent of the Internet and the big data era, the security issues of NCSs are being studied. A new ICA is proposed to study the communication security of the system.(2)
A more general LKF is constructed by utilizing the time-delay phenomenon inside the system. According to the characteristics of the sampling period, the constructed LKF contains more sampling information. In addition, the positive definiteness constraint on the initial matrices is further relaxed.(3)
For ICAs launched by hackers, we designed an ETM controller to ensure the AS of the NCS.


## 2. Preliminaries

In this article, we research the following NCSs:(1)x˙t=Axt+Bu˜t,where xt∈ℝn is the current state vector of the system; u˜t∈ℝm is the signal to control the input; and A and B are constant matrices.The control signals are represented as follows:(2)u˜t=ut+ft,where ft is the injection attack function.Remark 1.
The popularity of the Internet has made the processing of big data more efficient and faster. Therefore, studying the control of the system based on network communication has become a hot topic of research. There are always some signal fluctuations in the communication process of the control signal. Normal signal fluctuations of the control signal are acceptable. However, some abnormal signals are often injected into the system to destroy the systems’ performance, which we call ICAs. As shown in Figure2, the sensor communicates with the actuator through network communication with signal transmission. During this process, the system may be maliciously attacked by hackers. Therefore, this paper designs a suitable ETM controller for the communication security of NCSs to ensure the system’s regular operation.
Then, the controller can be designed as(3)ut=Kxtkh,t∈tkh,tk+1h,where K is a controller gain matrix.
In this framework, the sensor is time-triggered while the controller, the zero-order hold (ZOH), and the actuator are event-triggered.
We will illustrate our proposed security-orient resilient triggering strategy as follows:(4)tk+1h=tkh+minℓℓh|etkΦetk−δxTtkhΦxtkh>0,where etk=xtkh+ℓh−xtkh and Φ>0. xtkh is the latest transmitted signal at the latest triggering time tkh. The sampling interval is divided into tkh+ηtk,tk+1h+ηtk+1. η satisfies tkh+ηtk,tk+1h+ηtk+1=∪ℓ=0ηΩℓ, where Ωℓ=tkh+ℓh+ηtk+ℓ,tkh+ℓh+h+ηtk+ℓ+1, ℓ=0,1,…,η, and η=tk+1−tk−1. We define dt=t−tkh−ℓh and 0≤ηtk+ℓ≤ρt≤ρ, in which ρ≜h+ηtk+ℓ+1. From the definitions of ρt and etk, we can obtain xtkh=xt−ρt+etk.
Then, we can obtain(5)u˜t=Kxt−ρt−etk+ft.
From equations (1) and (5), the closed-loop system as follows:(6)x˙t=Axt+BKxt−ρt−etk+ft.Figure 2
Networked control system under injection attack.Assumption 1.
([19]). Any u1t and u2t∈ℝn2 meets the Lipschitz condition with the following form:(7)fTtft≤xTtFTFxt,where F is the upper bound of f·.Lemma 1 (see [28]).
GivenΩ>0 and integrate es over the interval a,b⟶ℝn×n, we know the matrix inequality holds:(8)−b−a∫abe˙sΩe˙sds≥−ζTΩζ−3ϖTΩϖ,where ζ=xb−xa and ϖ=xb+xa−2∫abxs/b−a.


## 3. Main Results

Theorem 1.
Given positive scalarsε, ν, α, hm, and hM, system (6) is AS; if there exist symmetric matrices P1, P2>0 and M1>0, M2, then any matrices R1, R2, and Yii=1,2,3 with appropriate dimensions satisfy the following LMIs:(9)P1+ρP2>0,M1+ρM2>0,(10)ΞρthkΠ1Π2T∗−ε1I0∗∗−ε2−1I<0,(11)ρt∈0,ρ,hk∈hm,hM,where other symbols and associated equations are expressed in Appendix B.Proof.
Construct a suitable LKF as follows:(12)Vxt=∑i4Vixt,t∈tkh,tk+1h,whereV1xt=αTtPρtαt,V2xt=h¯kh¯kδTtMρtδt,V3xt=h¯khM∫tkh−ρt−ρx˙TsR1x˙sds,V4xt=h¯khM∫t−ρtk+1h−ρx˙TsR2x˙sds,Pρt, Mρt, αt, δt, h¯k, h¯k, and ξt are listed in Appendix A.
Then, we can obtain the derivative ofVxt as follows:(13)dVxtdt=∑i4dVixtdt,t∈tkh,tk+1h,dVxtdt=2αTtPρtα˙t−ρ˙tαTtP2αt,=−ρ˙tαTtP2αt+2αTtPρtx˙t−xt−ρxt−ρ,=ξTtΞ1ξt,(14)dV2xtdt=h¯k−h¯kδTtMρtδt−ρ˙th¯kh¯k×δTtM2δt+2δTtMρtδ˙t,=h¯k−h¯kδTtMρtδt−ρ˙th¯kh¯k×δTtM2δt+2δtMρtxt−ρ00,=ξTtΞ2ξt,(15)dV3xtdt=−h¯khMx˙Tt−ρR1x˙t−ρ−hM∫tk+1h−ρt−ρx˙sR1x˙sds,(16)dV4xtdt=−h¯khMx˙Tt−ρR1x˙t−ρ−hM∫tk+1h−ρt−ρx˙sR1x˙sds.
By using Lemma1, we have(17)−hM∫t−ρtkh−ρx˙TsR1xsds≤hMh¯kxtkh−ρ−xt−ρ/xtkh−ρ+xt−ρ−2∫t−ρtkhh−ρxs/h¯kdsT×R1003R1xtkh−ρ−xt−ρxtkh−ρ+xt−ρ−2∫t−ρtkhh−ρxs/h¯kds≤hMhmξTtΩaTR¯Ωaξt,(18)−hM∫t−ρtk+1h−ρx˙TsR2xsds≤hMh¯kxtk+1h−ρ−xt−ρ/xtk+1h−ρ+xt−ρ−2∫t−ρtkh+1h−ρxs/h¯kdsT×R2003R2xtk+1h−ρ−xt−ρxtk+1h−ρ+xt−ρ−2∫t−ρtkh+1h−ρxs/h¯kds≤hMhmξTtΩbTR¯Ωbξt.
Thus, we know that the following inequality holds:(19)dV3xtdt+dV4xtdt≤ξTthMeTh¯kR2−h¯kR1e7+hMh¯kΩaR¯1Ωa+hMh¯kΩbR¯2Ωbξt=ξTtΞ3ξt.
Based on system (6), for any matrices Y1, Y2, and Y3, we have the following equation:(20)0=2eTtkY1+xTtkhY2+xTt−ρtY3×Axt+BKxt−ρt+BKft,=ξTtSymLϕξt+2LBKft.
According to Assumption1, we have the following equation:(21)2LBKft≤ξTtεΠ1Π1T+ε−1Π2TΠ2ξt.
Considering the rules of the designed event-triggered schemes, the following equation holds:(22)etkΦetk−δxTtkhΦxtkh=ξTtΘξt.
According to equations (13)–(22), the following equation hold:(23)dVxtdt≤ξTt∑i=13Ξi+SymLϕ+ε×Π1Π1T+ε−1Π2TΠ2+Θξt.
By using the LCCM, for all,dVxt/dt<0 are established. Then, using the Schur complement lemma, we know that (23) is equivalent to(24)ΞρthkΠ1Π2T∗−ε1I0∗∗−ε2−1I<0.
Therefore, it follows∑i4dVixt/dt<0. Finally, system (6) tends to AS.Remark 2.
Compared with existing works [26, 27, 29], this paper constructs a more general LKF for the time-delay phenomenon in systems: (1) when ρt=ρ, the constructed LKF will degenerate into being independent of time delay and (2) when ρt=0, the LKF contains correct time-delay information and time-delay derivative information. This method can introduce more information storage and reduce the conservativeness of the criterion.Remark 3.
Different from the traditional BLFs,V2xt constructed in this paper contains more sampling moments information h¯k and h¯k. When limt⟶tk+1+h¯k=limt⟶tk+h¯k=0 holds, there is no constraint on the matrices Mρt. The BLF constructed in this paper is a promotion and enhancement of the BLF in [30].Remark 4.
In this paper, we constructV3xt and V4xt. Compared with the LKF in reference [30], V3xt and V4xt contain the sampling period hM information and time-delay ρ information. Then, we obtain tighter upper bounds by scaling with appropriate integral inequalities, which ensures that the criterion is less conservative.Remark 5.
This paper analyzes the performance of the computer in the process of solving the LMIs. The computational complexity of Theorem1 is 7n2+2n. Then, based on Intel(R) Core(TM) i7-8700 CPU@3.20 GHz 3.19 GHz, pairs of large-scale LMIs are calculated.Theorem 2.
Given scalarsε, ν, α, ψ1, ψ2, hm, and hM, system (6) is AS; if there exist symmetric matrices P1, P2>0, M1>0, and M2, any matrices R1, R2, and N with appropriate dimensions satisfy the following LMIs:(25)P˜1+ρP˜2>0,M˜1+ρM˜2>0,(26)Ξ˜ρthkΠ˜1Π˜2T∗−ε1I0∗∗−ε2−1I<0,(27)ρt∈0,ρ,hk∈hm,hM,where other symbols and associated equations are expressed in Appendix C.Proof.
the matrices are defined asK=NX−1 and Φ˜=X−TΦX−1.
Then, other matrices are defined as follows:(28)Y1=X−1,Y2=ψ1X−1,Y3=ψ2X−1,P˜δt=diagXT,XT,XTPδtdiagX,X,X,M˜δt=diagXT,XT,XTMδtdiagX,X,X,R˜1=XTR1X,R˜1=XTR1X.
Premultiplying and postmultiplying (9) and (10) by diagXT,XT,XT and diagX,X,X, then according to Schur complement, we can derive the LMIs (25) and (26). The proof process is consistent with Theorem 1.


## 4. Illustrative Example

Example 1.
Consider a NCS, the parameters are as follows [25]:(29)A=010−0.1,B=00.1.


### 4.1. Case A: The System Is in Normal State

In this case, our research system is operating normally in a safe state. Whenρ=0, F=0, and hm=0.1, we solve for maximum acceptable sampling periods (MASPs) by using Theorem 2. It can be seen from Table 1 that the MASPs hM under different δ are better than reference [25]. When δ=0.3, the hM=1.0061 solved in this paper is 24.2521% higher than the result of reference [25].Table 1
MASPshM for different δ’s.
δ[25]Theorem2Improvement (%)01.69821.960113.36090.11.15961.492714.94960.20.93461.085413.89350.30.76211.006124.25210.40.61690.959235.68600.50.48940.681328.1667To verify the validity of the criterion, we solve the controller gain matrix isK=50.4168−17.8803 by using the Yalmip toolbox in Matlab. Then, we set hm=hM=0.01, δ=0.3, and x0=−10,7T; furthermore, the stability of the system is verified by plotting the state trajectory images of the system.In Figure3, we can see that with the increase in time, the running trajectory of the system will fluctuate. But it eventually converges on a steady state. This means that the controller we designed is suitable. In order to more intuitively reflect the effect of the controller designed in this paper, we also draw Figure 4 of the running trajectory of the system when the controller fails.Figure 3
State responses of the original system with control.Figure 4
State responses of the original system without control.In addition, the release time distribution and control signal input are shown in Figures5 and 6, respectively.Figure 5
Release instants and time intervals.Figure 6
Control input signalut.


### 4.2. Case B: The System Is in Abnormal State

In this case, we conducted a simulation experiment, as in Case A. Whenρ=0, hm=0.1, F1=0.1, and F2=0.1, the MASPs solved by using Matlab are shown in Table 2. Table 2 shows that the performance of the system is reduced when the system is attacked. However, the method proposed in this paper can still ensure the stability of the system. Assuming δ=0.3, we solve hM=1.0061 when the system is running normally. However, solve for hM=0.8916 when ICAs constrain the system. By comparing the results, we know that although 11.3806% reduces the performance, our criterion is still less conservative than the results in reference [25].Table 2
MASPshM for different δ’s under ICA.
δ[25]Case ACase BReduction (%)01.69821.96011.503923.27430.11.15961.49271.172521.45110.20.93461.08540.99678.17210.30.76211.00610.891611.38060.40.61690.95920.710925.88610.50.48940.68130.459332.5845Then, whenψ1=ψ2=1 the controller gain is K=27.8726−10.5776. Setting ρ=0, hm=hM=0.01, and δ=0.3, the initial condition is x0=4,−1T. We assume that the attack function injected by the hacker is ft=−tanh0.5xt,−tanh0.25xtT. When the system is subjected to ICAs, we plot the state trajectory of the system in Figure 7. Compared with the normal running trajectory in Figure 3, we can see that the system oscillates more obviously and can still reach a stable state eventually. Furthermore, the trajectory of the system in the case of controller failure is plotted in Figure 8.Figure 7
State responses of the original system with control.Figure 8
State responses of the original system without control.Finally, we plot the release time distribution of the system in Figure9 and the control signal input in Figure 10.Figure 9
Release instants and time intervals.Figure 10
Control input signalut.


## 4.1. Case A: The System Is in Normal State

In this case, our research system is operating normally in a safe state. Whenρ=0, F=0, and hm=0.1, we solve for maximum acceptable sampling periods (MASPs) by using Theorem 2. It can be seen from Table 1 that the MASPs hM under different δ are better than reference [25]. When δ=0.3, the hM=1.0061 solved in this paper is 24.2521% higher than the result of reference [25].Table 1
MASPshM for different δ’s.
δ[25]Theorem2Improvement (%)01.69821.960113.36090.11.15961.492714.94960.20.93461.085413.89350.30.76211.006124.25210.40.61690.959235.68600.50.48940.681328.1667To verify the validity of the criterion, we solve the controller gain matrix isK=50.4168−17.8803 by using the Yalmip toolbox in Matlab. Then, we set hm=hM=0.01, δ=0.3, and x0=−10,7T; furthermore, the stability of the system is verified by plotting the state trajectory images of the system.In Figure3, we can see that with the increase in time, the running trajectory of the system will fluctuate. But it eventually converges on a steady state. This means that the controller we designed is suitable. In order to more intuitively reflect the effect of the controller designed in this paper, we also draw Figure 4 of the running trajectory of the system when the controller fails.Figure 3
State responses of the original system with control.Figure 4
State responses of the original system without control.In addition, the release time distribution and control signal input are shown in Figures5 and 6, respectively.Figure 5
Release instants and time intervals.Figure 6
Control input signalut.


## 4.2. Case B: The System Is in Abnormal State

In this case, we conducted a simulation experiment, as in Case A. Whenρ=0, hm=0.1, F1=0.1, and F2=0.1, the MASPs solved by using Matlab are shown in Table 2. Table 2 shows that the performance of the system is reduced when the system is attacked. However, the method proposed in this paper can still ensure the stability of the system. Assuming δ=0.3, we solve hM=1.0061 when the system is running normally. However, solve for hM=0.8916 when ICAs constrain the system. By comparing the results, we know that although 11.3806% reduces the performance, our criterion is still less conservative than the results in reference [25].Table 2
MASPshM for different δ’s under ICA.
δ[25]Case ACase BReduction (%)01.69821.96011.503923.27430.11.15961.49271.172521.45110.20.93461.08540.99678.17210.30.76211.00610.891611.38060.40.61690.95920.710925.88610.50.48940.68130.459332.5845Then, whenψ1=ψ2=1 the controller gain is K=27.8726−10.5776. Setting ρ=0, hm=hM=0.01, and δ=0.3, the initial condition is x0=4,−1T. We assume that the attack function injected by the hacker is ft=−tanh0.5xt,−tanh0.25xtT. When the system is subjected to ICAs, we plot the state trajectory of the system in Figure 7. Compared with the normal running trajectory in Figure 3, we can see that the system oscillates more obviously and can still reach a stable state eventually. Furthermore, the trajectory of the system in the case of controller failure is plotted in Figure 8.Figure 7
State responses of the original system with control.Figure 8
State responses of the original system without control.Finally, we plot the release time distribution of the system in Figure9 and the control signal input in Figure 10.Figure 9
Release instants and time intervals.Figure 10
Control input signalut.


## 5. Conclusion

This paper has considered the secure stability issue of NCSs under ICAs, which have important research value of applications for network security. Firstly, a more general LKF has been constructed based on the time-delay phenomenon in the system. Secondly, a novel BLF has been developed depending on the sampling period, fully considering time delay and sampling information, and the initial constraints on the criterion on the matrices have been effectively relaxed. In addition, appropriate integral inequalities have been used, making the criteria less conservative in this paper. Then, a new ETM controller under ICAs has been designed to control the AS of NCSs. Finally, a numerical experiment has verified the correctness and feasibility of the theory. In the future, we extend this method and safety control strategy to T-S fuzzy systems, switching systems, Markov hopping systems, and some other systems.



---

*Source: 4167304-2022-04-25.xml*