# Static Output Feedback Predictive Control for Cyber-Physical System under Denial of Service Attacks

Authors: Zhiwen Wang; Xiaoping Wang; Hongtao Sun; Peng Xin
Journal: Mathematical Problems in Engineering
 (2020)

---

## Abstract

This paper addresses the static output feedback predictive (SOFP) control problem with cyber-physical system (CPS) subject to Denial-of-Service (DoS) attacks. The effects of DoS attacks are reasonably assumed to the bounded consecutive packet dropouts by considering the energy constraints of an attacker. Then, a novel predictive control sequence, in which only the latest successfully received output is employed, is designed to compensate such packet dropouts caused by DoS attacks. Furthermore, the stability criterion and predictive control design are carefully derived by using the switching Lyapunov functional approach and linear matrix inequality. Compared with the previous works, the proposed predictive control strategy can compensate arbitrary packet dropouts under DoS attacks while only the latest successfully received output is available. At last, a simulation example illustrates the effectiveness of the SOFP control strategy.


---

## Body

## 1. Introduction

The rapid development of CPS is attributed to the strong integration among computation, communication, and control technology, in which CPS has received considerable attention in the past decades. Taking advantage of low cost and flexible network architecture, it has been widely applied in some engineering fields such as smart grid, healthcare, and water/gas distribution and industrial process control [1–3].Due to the capacity of connecting deeply integration physical plants and cyber elements in an unprecedented way, CPS offers ample opportunities for malicious threats to launch attacks. The applications of next-generation information technologies such as big data, cloud computing, and Internet of Things greatly provide performance improvements for physical systems but at the same time introduce more risks which make physical isolation more difficult to implement. Therefore, how to ensure the safe operation and preserve the control performance under malicious attacks are the basic security issues in CPS. In fact, CPS has realized more complex and high-risk industrial process control through the transmission of information in the heterogeneous network [4]. However, the vulnerability of open communication networks, as the key components of society safety-critical infrastructures in CPS, increases the severity of such malicious cyber-attacks in [5], which can menace the control systems. There have been an increasing number of cyber-attacks on power grids reported worldwide. For instance, a devastating cyber-attack on the power station brought down the information flow from the physical process to the remote management system, which plunges 225,000 people into blackout in Ukraine [6]. Besides, the “Stuxnet”, an advanced computer worm virus, intruded the nuclear facility and caused severe damage in Iran [7]. These facts show the serious economic loss and severe social detriment attacked by malicious network in CPS, which has attracted extensive attention of many scholars [8–10].The typical network attacks in CPS are categorized as deceptive attack, false data injection attack and DoS attack in [11]. The DoS attack, a more reachable attack pattern, prevents the exchange of information for the adversary, while the false data injection attack affects the data integrity of packets by modifying their payloads in [12]. The essence of DoS attack is that the measurement state or the control signal transmitted through the wireless communication network is blocked, which results in the fact that the information update is not timely and complete. Thus, the DoS attack focuses on deteriorating the system performance and even leads to system instability. One of the main issues under DoS attacks in CPS is the packet dropout phenomenon [13]. It should be pointed out that information data can be transmitted in a “packet”, which implies sending a sequence of control prediction in one data packet and then selecting the appropriate one corresponding to the current network condition to compensate the packet dropout. In this case, the SOFP control strategy has been proposed in this paper.In many existing works, various efforts have been devoted to the security control influenced by DoS attacks. Some of the literatures focused on the effects of network-induced delays. Many methods for the delay issue have been done in [14–16]. Some other literatures show that a large number of the approaches have been investigated to alleviate the severe impact influenced by packet dropouts. A defence strategy is proposed to deal with the information flow which congests the transmission signal between the sensor and the controller against DoS attacks on the multichannel CPS in [17]. In addition, some necessary scheduling algorithms are proposed to ensure transmission security when control plants can gain access to the network at each sampling instant because of the limitation of network bandwidth. If there is no optimal scheduling algorithm in CPS design, the packet dropout in smaller sampling frequency should be considered. That is, it not only ensures the system is schedulable and guarantees that the overall CPS is stable. Then, the relationship based applicable scheduling algorithm design between the packet dropout rate and the stability of the closed-loop system should be established, and the corresponding controllers design procedures to make the closed-loop system stability should be given. As stated in [18–20], such as the stochastic system and the switching system method, some effective strategies are employed to address the model and control issues with packet dropout. The networked system with arbitrary and finite packet loss is modelled as a switching system, and the design control method of state feedback is proposed in [21]. Furthermore, by using the measured output information, a token-dependent static output feedback SMC is designed in [22]. By only considering attacks in the backward channels in [23, 24], the security control is established to address attack-induced severe packet dropout. Notice that both-side communication with arbitrary packet dropout caused by attacks is more realistic in the practical attack pattern and the state feedback controller is given in [25].Motivated by the fact that not all states are available and only the latest received output measurements can be obtained at the controller, the SOFP control strategy is proposed to deal with the security control problem. In contrast with the existing results, the main contributions of this paper can be summarised as follows:(1)
A novel switching system model is established to characterize the security properties of CPS under DoS attacks. Different from [26], only limited output measurements are used to design the security controller in this paper.(2)
Only the latest received measurements are used to design the proposed predictive control gains. Compared with traditional model predictive control methods, the proposed security control strategy will predict their future control gains rather than state prediction.The remainder of this paper is organized as follows. Section2 gives the problem formulations with the proposed SOFP control strategy by considering the energy-limited DoS attacks. Section 3 is presented in the security analysis, which infers the stability criterion to guarantee the security performance. The SOFP controller is designed in Section 4, and a simulation example is shown in Section 5 to illustrate the feasibility of the desired controller. And finally, Section 6 concludes this paper.Notation:Rn and Rm denote the n-dimensional and m-dimensional Euclidean space, respectively. Rn×m is the set of n × m real matrices. The superscript “T” stands for matrix transposition. The notation X > 0 means that the matrix X is real symmetric positive definite.


## 2. Problem Formulations

### 2.1. System Framework

The structure of SOFP control considered in this paper is shown in Figure1, where the studied CPS is composed by the sensor, controller, buffer, and actuator. The SOFP control strategy against attack-induced severe packet dropout is that the controller receives all the measurement outputs from sensor and calculates the sequence of control inputs, which transmits to the buffer simultaneously. Then, the actuator selects the corresponding control value from uthT,uth+1T,…,uth+τTT and delivers appropriate control inputs to the plant, which can compensate the arbitrary packet dropouts caused by DoS attacks.Figure 1
Structure of the SOFP control under DoS attacks.Consider a discrete-time linear system described by(1)xt+1=Axt+But,yt=Cxt,where t+1≜t+1T, T represents the sampling period, xt∈Rn and ut∈Rm are the system state and control input, respectively, and A,B are real matrices of appropriate dimensions.To make the proposed method more suitable for practical network attacks, the DoS attacks behaviours considered energy constraints are presented as(2)Hn≔hn∪hn,hn+τ,where τ is the attack duration and hn is the instant transition time of the attack state.As shown in Figure2, “↑” denotes that the DoS is converted to the attack state and “↓” indicates that the DoS is the end of the attack process. When τ∈R≥0, the DoS launches a limited attack with the duration of τ (τ=0 is a pulse attack only).Figure 2
An illustration of the DoS attacks.To clearly describe the energy-limited characteristics of DoS attacks in this paper, the following assumption is given.Assumption 1.
The maximum packet dropouts of consecutive DoS attacks are bounded withN.Remark 1.
In practice, the attackers gradually run out of energy because of an inherent characteristic of energy constraints [27]. Based on this reliable fact, it is reasonable to consider that the packet dropouts of consecutive DoS attacks are bounded. Furthermore, to achieve predictive compensation for packet dropout, a data buffer is involved at the controller side to record recently successfully transmitted data packets.


### 2.2. Switching Model under DoS Attacks

Suppose that the controller latest received the value of process outputyth at time th, then the predictive control based on output feedback control law is given by(3)uth+τ=Gτyth,where th+τ≜th+τT, th stands for the switching instant time, and τ=0,1,…,σth is a time-varying switching signal which takes the value in a finite set τ∈Z≜0,1,…,N.The packet-based transmission mechanism in CPS determines that the corresponding control input at timeth,th+1,…,th+τ is uth,uth+1,…,uth+τ, respectively. It is known that the neighboring two switching points have the following relation:(4)th+1=th+1+σth,t0=0.Therefore, the evolution law of dynamics can be described by the followingN+1 cases:Case 0. DoS-freeσth=0:(5)xth+1=A+BG0Cxth,th+1=th+1,xth+1=xth+1=Φ0xth,Φ0≜A+BG0C.Case 1. One-step packet dropoutσth=1:(6)xth+1=A+BG0Cxth,xth+2=Axth+1+BG1Cxth,th+1=th+2,xth+1=xth+2=Φ1xth,Φ1≜AΦ0+BG1C,⋮Case N: N-steps packets dropouts σth=N:(7)xth+1=A+BG0Cxth,xth+2=Axth+1+BG1Cxth,⋮xth+1+N+1=xth+N+BGNCxth,th+1=th+N,xth+1=xth+1+N+1=ΦNxth,ΦN≜AΦN−1+BGNC.According to (5)–(7), model (1) with SOFP control strategy can be transformed into the following closed-loop system included N-steps packet dropouts:(8)xth+1=Φixth,where Φi=Ai+1+∑l=0iAlBGi−lC. It illustrates the essential characteristics of the proposed SOFP control strategy, that is, the state is unchanged and the controller gain is changed.


## 2.1. System Framework

The structure of SOFP control considered in this paper is shown in Figure1, where the studied CPS is composed by the sensor, controller, buffer, and actuator. The SOFP control strategy against attack-induced severe packet dropout is that the controller receives all the measurement outputs from sensor and calculates the sequence of control inputs, which transmits to the buffer simultaneously. Then, the actuator selects the corresponding control value from uthT,uth+1T,…,uth+τTT and delivers appropriate control inputs to the plant, which can compensate the arbitrary packet dropouts caused by DoS attacks.Figure 1
Structure of the SOFP control under DoS attacks.Consider a discrete-time linear system described by(1)xt+1=Axt+But,yt=Cxt,where t+1≜t+1T, T represents the sampling period, xt∈Rn and ut∈Rm are the system state and control input, respectively, and A,B are real matrices of appropriate dimensions.To make the proposed method more suitable for practical network attacks, the DoS attacks behaviours considered energy constraints are presented as(2)Hn≔hn∪hn,hn+τ,where τ is the attack duration and hn is the instant transition time of the attack state.As shown in Figure2, “↑” denotes that the DoS is converted to the attack state and “↓” indicates that the DoS is the end of the attack process. When τ∈R≥0, the DoS launches a limited attack with the duration of τ (τ=0 is a pulse attack only).Figure 2
An illustration of the DoS attacks.To clearly describe the energy-limited characteristics of DoS attacks in this paper, the following assumption is given.Assumption 1.
The maximum packet dropouts of consecutive DoS attacks are bounded withN.Remark 1.
In practice, the attackers gradually run out of energy because of an inherent characteristic of energy constraints [27]. Based on this reliable fact, it is reasonable to consider that the packet dropouts of consecutive DoS attacks are bounded. Furthermore, to achieve predictive compensation for packet dropout, a data buffer is involved at the controller side to record recently successfully transmitted data packets.


## 2.2. Switching Model under DoS Attacks

Suppose that the controller latest received the value of process outputyth at time th, then the predictive control based on output feedback control law is given by(3)uth+τ=Gτyth,where th+τ≜th+τT, th stands for the switching instant time, and τ=0,1,…,σth is a time-varying switching signal which takes the value in a finite set τ∈Z≜0,1,…,N.The packet-based transmission mechanism in CPS determines that the corresponding control input at timeth,th+1,…,th+τ is uth,uth+1,…,uth+τ, respectively. It is known that the neighboring two switching points have the following relation:(4)th+1=th+1+σth,t0=0.Therefore, the evolution law of dynamics can be described by the followingN+1 cases:Case 0. DoS-freeσth=0:(5)xth+1=A+BG0Cxth,th+1=th+1,xth+1=xth+1=Φ0xth,Φ0≜A+BG0C.Case 1. One-step packet dropoutσth=1:(6)xth+1=A+BG0Cxth,xth+2=Axth+1+BG1Cxth,th+1=th+2,xth+1=xth+2=Φ1xth,Φ1≜AΦ0+BG1C,⋮Case N: N-steps packets dropouts σth=N:(7)xth+1=A+BG0Cxth,xth+2=Axth+1+BG1Cxth,⋮xth+1+N+1=xth+N+BGNCxth,th+1=th+N,xth+1=xth+1+N+1=ΦNxth,ΦN≜AΦN−1+BGNC.According to (5)–(7), model (1) with SOFP control strategy can be transformed into the following closed-loop system included N-steps packet dropouts:(8)xth+1=Φixth,where Φi=Ai+1+∑l=0iAlBGi−lC. It illustrates the essential characteristics of the proposed SOFP control strategy, that is, the state is unchanged and the controller gain is changed.


## 3. Stability Analysis

In this section, the security analysis based SOFP strategy is given with some mathematical derivations. The following necessary definition and lemmas are introduced.Definition 1.
If there are positive scalarsc and λ<1 such that the following inequality,(9)xt≤cλtx0,holds, the CPS (1) is said to be exponentially stable, where x0∈Rn is an arbitrary initial value.Lemma 1 (see [27]).
For an arbitrary matrixΨ∈Rn×n and an arbitrary vector x∈Rn, the following inequality,(10)λminx≤Ψx≤λmaxx,holds, where λmin and λmax are the minimum singular value and the maximum singular value, respectively, of Ψ.
Based on the above, the following theorem gives criteria for system exponentially stable with arbitrary switching characteristics under DoS attacks.Theorem 1.
For some given scalars0<λi<1, μ>0, if there exist matrices Pi>0, such that the following inequalities,(11)−λiPi+ΦiTPiΦi<0,(12)Pα<μPβ,∀α,β∈Z≜0,1,…,N,(13)ρ≜maxλiμi∈Z<1,hold, then the system (8) will be exponentially stable with the decay rate ρ2N+2.Proof.
Choose the following Lyapunov function:(14)Vσthth=xTthPσthxth.
Therefore, it is derived from (14) at time th+1 that(15)Vσthth+1=xTth+1Pσthxth+1.
Then, pre- and post-multiplying inequality (11) by xTth and xth, one has(16)ΦσthxthTPσthΦσthxth−λσthxTthPσthxth<0.
Substituting the function (14) and (15) into (16), we have,(17)Vσthth+1<λσthVσthth.
Similarly,(18)Vσth+1th+2<λσth+1Vσth+1th+1.
Suppose that one-step packet dropout at timeth+1 and th+2 caused by DoS attacks, respectively. Thus, we obtain that(19)Vσth+1th+1=xTth+1Pσth+1xth+1,(20)Vσth+1th+2=xTth+2Pσth+1xth+2.
Utilizing (12) and (18) together leads to(21)Vσth+2th+2<μVσth+1th+2<μλσth+1Vσth+1th+1<μλσth+1μVσthth+1<μλσth+1μλσthVσthth.
Defineρ=μλσth+1, then the above law (21) can be written as(22)Vσth+2th+2<ρVσth+1th+1<ρ2Vσthth<⋯<ρt+1Vσt1t1<ρt+2Vσt0t0.
Then, it is concluded from (13) and (14) that(23)limt⟶∞xth=0.which implies that the system will be stable in xt.
Notice that the system should not only be stable in the discrete regionsxt but also converge to the subset xtd,h after dT sampling periods.
Therefore, by Lemma1, we obtain by induction that the following inequality holds:(24)xtd,h≤ξxth,where ξ≜maxσmaxΦii=0,1,…,N−1. It means that the upper bounded value of xtd,h is ξxth. Thus,(25)limt⟶∞xtd,h=0.
Based on the above analysis, the closed-loop switching system (8) tends to be exponentially stable and then the exponential decay rate is obtained.
It is deduced from (19) that(26)Vσth+2th+2=xTth+2Pσth+2xth+2.
Further, it is easy to see that(27)Vσth+2th+2=xTth+2Pσth+2xth+2≥η1xth+22.
It is derived from (22) that(28)η1xth+22≤ρVσth+1th+1<ρ2Vσthth<⋯<ρt+2Vσt0t0≤ρt+2η2x02,where η1 and η2 are the minimum singular value and the maximum singular value, respectively, of P.
Therefore, it is easy to know from (28) that(29)xth+2<ρt+2η2η1x02.
Substituting (24) into (29), it can be found that(30)xtd,h+2≤xth+2<ξρt+2η2η1x02.
Meanwhile,td,h+2, th+2, and t+2 have the following relations:(31)th+2≤N+1t+2.(32)td,h+2≤N+1t+2+N≤N+2t+2,where h+2≥N.
It is clearly deduced from (31) and (32) that(33)th+2N+1≤t+2.
Because ofρ<1, the following inequalities hold.(34)xth+2<ρ2N+1th+2η2η1x02,(35)xtd,h+2<ξρ2N+2td,h+2η2η1x02,where h+2≥N.
Finally, we can further obtain from (34) and (35) that, for an arbitrary instant time t, the following inequality,(36)xt<ξρ2N+2tη2η1x02,holds. The proof is thus completed.


## 4. Control Design of SOFP

In this section, the SOFP control sequence based on Theorem1 is derived below.Theorem 2.
For given scalars0<λi<1, μ>0, if there exist matrices X, Ωi, and Pi>0, such that the following inequalities,(37)−λiΩi∗Ξ−X−XT+Ωi<0,(38)Ωα<μΩβ,∀α,β∈Z≜0,1,…,N,(39)ρ≜maxλiμi∈Z<1,where Ξ=Ai+1+∑l=0iAlBGi−lCX, hold, then the system (8) will be exponentially stable with the decay rate ρ2N+2.Proof.
According to the stability condition of the discrete-time linear system, for matricesA, P>0, the following inequality,(40)ATPA−P<0,holds, if and only if there exists a matrix Ψ such that(41)−P∗ΨA−Ψ−ΨT+P<0.
Therefore, the inequality (11) will be held if there exists a matrix Ψ such that the following inequality,(42)−λiPi∗ΨΦi−Ψ−ΨT+Pi<0,holds. Based on this fact, the controller can be easily obtained below.
DefineX=Ψ−1and Ωi=XTPiX. Then pre- and postmultiplying inequality (42) by diagΨ−T,Ψ−T and Ωi=XTPiX (notice from (41) that the matrix Ψ is invertible), one has(43)−λiΩi∗ΦiX−X−XT+Ωi<0.
Substituting (5)–(7) into (43),(44)−λiΩi∗Ai+1+∑l=0iAlBGi−lCX−X−XT+Ωi<0.
It can be found that the inequalities (44) and (37) in Theorem 2 are equivalent.
Meanwhile, the inequality (38) in Theorem 2 is derived by pre- and post-multiplying XT, X for Pα<μPβ,∀α,β∈Z. This completes the proof.
However, the above inequalities still cannot be solved due to the coupling nonlinear itemABGCX. In order to deal with such items, Theorem 3 transformed nonlinear item is presented.Theorem 3.
For given scalars0<λi<1, ε>0, if there exist matrices X, Ωi, and Pi>0, full rank matrix M, and any matrix V of appropriate dimensions such that the following inequalities,(45)−λiΩi∗Ξ˜−X−XT+Ωi<0,(46)−εI∗MC−CX−Iε⟶0,<0,where Ξ˜=Ai+1X+∑l=0iAlBVτC,τ=i−l, hold, then the system (8) secured by Gτ=VτM−1 will be exponentially stable with the decay rate ρ2N+2.Proof.
It is deduced from (44) that C=M−1CX. By replacing GτCX with VτC, we can easily obtain the above result with Gτ=VτM−1 which completes this proof.


## 5. Simulation Example

In this section, an inverted pendulum control system is presented to illustrate the proposed security method with the SOFP control strategy. The plant model is described as(47)u=Md2ydt2+md2dt2y+lsinϕ,mglsinϕ=md2dt2y+lsinϕlcosϕ,and the inverted pendulum system is shown in Figure 3.Figure 3
Single inverted pendulum system.Based on the above inequality, the initial state variables of the system can be defined as(48)x1=y,x2=ϕ,x3=y˙,x4=ϕ˙.To make the description simpler, the inverted pendulum control system takes the following parameters, which are given in Table1.Table 1
Parameters of the inverted pendulum system.
SymbolMeaningValueMMass of the cart1.378 kgmMass of the pendulum0.051 kglLength of the pendulum0.25 mgAcceleration of gravity9.8 m/s2ΦAngle from the upright position—Let the sampling periodT=0.01s, then the discrete-time model of the inverted pendulum is given as(49)xk+1=Axk+Buk,yk=Cxk,where(50)A=0100000000010029.430,B=0103T,C=10000010.In the simulation settings, by selectingδ=0.85, μ=1, λ0=λ1=λ2=λ3=0.9. The initial condition is set to be x0=10000T and the simulation time is chosen as t∈010. Then, the stabilization control law in Theorem 3 can be resorting to LMI toolbox in MATLAB. Suppose that the maximum number of packet dropouts is N=3 under the worst attacks in this simulation example. Therefore, the corresponding gain G=−3.78081.9434 is obtained. Meanwhile, the distribution of DoS attacks is shown in Figure 4.Figure 4
Distribution of DoS attacks.Case I. DoS-free case:The state responses of the system (49) with the designed controller under DoS-free case are shown in Figure 5, in which the stability of the studied is verified. It is worth noting that the angle value in Figures 5–7 has been reduced by one tenth in order to make a more intuitive comparison between the angle and position curves.Case II. DoS attacks case:In the second scenario, the designed controller in Case I is still used. Under the DoS attacks in Figure4, the state responses of the system (49) are depicted in Figure 6. It is evident that the angle and position states of the inverted pendulum system are not convergent, in which state responses are presented in a worse performance. Thus, one can see that the switching system is unstable when there are no SOFP control inputs to confront uncertain packet dropouts caused by DoS attacks.Case III: DoS attacks migration with SOFPFigure 5
State responses of CPS with DoS-free case.Figure 6
State responses of CPS under the worst DoS attacks.Figure 7
State responses of CPS with SOFP control under the worst DoS attacks.The third scenario considered the SOFP control strategy. In such case, the corresponding output feedback gainG against the worst attacks is employed to ensure system stability and maintain the desired control performance. Similarly, we can obtain the following in Figure 7.Based on the angle and position curves, the proposed method is effective, as the control strategy demonstrates that the closed-loop system is stable with bounded packet dropouts. One can see that the system performance is better than the one without predictive control. As a result, the proposed packet-based compensation control method has certain robustness and security.According to the simulation examples shown above, it can be summarised that the designed controller is stable against DoS attacks and the feasibility of the proposed designing method is verified.


## 6. Conclusion

In this paper, a novel predictive control strategy is proposed to cope with packet dropouts caused by DoS jamming attacks. Firstly, the discrete-time switched linear control system is formulated to characterize the properties of CPS under DoS attacks. Then, the stability criterion is derived, and the predictive control sequences have been given by LMIs. Finally, the corresponding simulation example results have shown the validity of the SOFP control method.



---

*Source: 5412170-2020-08-31.xml*