# Output Feedback NCS of DoS Attacks Triggered by Double-Ended Events

Authors: Xinzhi Feng; Yang Yang; Xiaozhong Qi; Chunming Xu; Ze Ji
Journal: Security and Communication Networks
 (2021)

---

## Abstract

In recent years, the research of the network control system under the event triggering mechanism subjected to network attacks has attracted foreign and domestic scholars’ wide attention. Among all kinds of network attacks, denial-of-service (DoS) attack is considered the most likely to impact the performance of NCS significantly. The existing results on event triggering do not assess the occurrence of DoS attacks and controller changes, which will reduce the control performance of the addressed system. Aiming at the network control system attacked by DoS, this paper combines double-ended elastic event trigger control, DoS attack, and quantitative feedback control to study the stability of NCS with quantitative feedback of DoS attack triggered by a double-ended elastic event. Simulation examples show that this method can meet the requirements of control performance and counteract the known periodic DoS attacks, which save limited resources and improve the system’s antijamming ability.


---

## Body

## 1. Introduction

Scholars have recently devoted much energy to studying network security and control stability of network systems against malicious attacks, including denial of service (DoS) attacks, replay attacks, and spoofing attacks. The research results on different types of network attacks can be obtained in the literature [1–5].Among all kinds of network attacks, the DoS attack is considered the most likely type of network attack to impact the performance of NCS [6] significantly. In the past few years, the stability analysis of NCS under DoS attacks has been reported in the literature [7, 8]. Besides, because the event-triggered mechanism can be used to reduce the transmission of information without reducing the overall system performance, in recent years, more and more literature have used the event-triggered method to study the control stability of NCS under DoS attacks [9]. For example, in [6], the author, for the first time, investigated the stability analysis of event-triggered networked linear continuous-time systems under known pulse width modulation DoS attacks. Inspired by this work, the author proposes a more general DoS attack model in [10], in which the DoS attack signal is only constrained by DoS frequency and duration. Some extensions are also reported based on this idea, such as the dynamic output feedback controller [11] and distributed NCS [12].An event trigger mechanism dependent on the Lyapunov function is proposed for nonlinear continuous systems in [13]. Eqtami et al. [14] use ISS’s technology to propose a self-triggering mechanism and a new event triggering mechanism for nonlinear discrete systems. A new event mechanism is proposed for nonlinear systems through Lyapunov in [15]. The asymptotic stability of the system is verified by using the distributed event trigger mechanism in [16], and the small gain theorem for the ISS-Lyapunov function [11] solved the resource consumption and resilient control strategy design of NCS subjected to malicious DoS attacks. In the presence of DoS attacks, the proposed system framework can still guarantee a strictly positive and lower bound on the event time. A system design framework is proposed for the output-based dynamic event trigger control (ETC) system under DoS attacks. De Persis and Tesi [17] studied the effective control strategy of nonlinear systems under a DoS attacks and provided the character of the maximum percentage of time that feedback information can be lost without causing feedback instability. It is based on the design of the event’s elastic control strategy, and the fixed pattern is used as an exact representation of the interval activity interval. The controller triggered by the event has made a clear representation of the minimum cross-sampling time of the controller. Su et al. [18] proposed incremental algorithms for rapidly evolving the network strategies, and the redundancy rules are further processed.Focusing on defensive strategies against network attacks in cyberphysical system (CPS), Tian et al. [19] proposed both low- and high-interaction honeypots into CPS as a security management tool deliberately designed to be probed, attacked, and compromised. To improve the attack detection capability of content centric network (CCN), Xu et al. [20] proposed a way of interest flooding attack (IFA) making use of the characteristics of self-similarity of traffic and the information entropy of content name of interest packet.Distributed Denial-of-Service (DDos) attack has become one of the most destructive network attack. Cheng et al. [21] proposed a detection method of DDos’ attacks based on generalized multiple kernel learning combining with the constructed parameter R, and the proposed method can effectively detect DDos’ attacks in complex environments with a higher rate and lower error rate. Chen et al. [22] provided the active approach based on the integrated entropy calculations to detect DDos’ attack. It is a lightweight approach could be applied in mobile device.


## 2. Preparation

### 2.1. LMI

The research on LMI (linear matrix inequalities) has been widespread. When it is used to solve control problems, LMI will be used to simplify the practical issues involved. Here are some definitions of LMI and many practical issues of LMI implementation used in later sections [23]. In general, the specific LMI, formula is(1)Gx=G0+x1G1+⋯+xmGm<0,where x1,x2,…,xm−1,xm.. is the measure decision variable of LMI. x=x1,x2⋯xm−1,xmT∈Rm is the decision vector Gi=GiT∈Rn×n,i=0,1,…,m is a symmetric matrix. Equation (1) is the general form of LMI, but through the exploration of scholars, most of the content of its solution is a variable matrix. If the following Lyapunov inequality(2)GX=XA+ATX+Q<0,where Q∈Rn×n is a real symmetric matrix, A∈Rn×n is a constantly fixed matrix, X∈Rn×n is an unknown solution matrix, so most of the contents of the LMI solution are variable matrices. Formulas (1) and (2) are two representations of LMI, but they embody the same essence. Therefore, the resolution of a kind of LMI problem [24] is obtained as follows: for the existing LMI Gx<0, we can use the function that comes with LMI to solve it, in which there is a function with special meaning, which can be used to test whether the existing x satisfies Gx<0. This kind of case is the LMI technique to solve the problem, and the solver in the function is expressed by feasp.


### 2.2.H∞ Control Theory

As the core part of robust control,H∞, the theory provides many analysis ideas for control systems and effective solutions for robustness exploration. It can realize the calculation of H∞ the norm. By optimizing this kind of function and then designing the controller reasonably within the prescribed constraint conditions, the robustness of the system becomes very good. The block diagram of H∞ control is shown in Figure 1.Figure 1
The structure of theH∞ problem.In addition,u is the output information of the controller, P is the controlled object, w is the external interference information, z is the information output of the object, y is the measured value, and K is the controller.System objects are considered as follows:(3)x˙t=A¯11xt+B¯11ut+B¯1wwt,zt=C¯22xt+D¯11wt+D¯12ut,yt=C¯33xt+D¯31wt+D¯32ut,where ut∈Rm is the input vector of the system, yt∈Rs is the measured output of the system, xt∈Rn denotes the state vector, zt∈Rq represents the control output of the system, and wt∈ℒ20,∞ represents the information of the disturbance signal. A¯11,D¯32,B¯11,B¯1w,C¯33,D¯21,C¯22,D¯11,D¯12 is a fixed constant matrix.For anyγ>0, if formula (3) contains the following properties:(1)
Ifwt=0, then the system is stable.(2)
If the functionΦs is used to represent the relationship between zt and wt by calculating the norm, we have(4)Φs∞=supw2≤1z2w2≤γ2.And, then it is equal to(5)∫0∞γ2wTtwtdt≥∫0∞zTtztdt,∀wt∈ℒ20,∞.Then, system (5) has H∞ performance γ [25].Formula (5) is the ability of anti-interference to the outside world, so γ is called the suppression system to the outside world. The smaller the value of γ is, the better the control performance of the system will be.


### 2.3. Some Lemmas

Lemma 1.
(Jensen inequality). For constant matricesW∈Rn×n,W=WT≥0, scalar 0≤τ1≤τ2, and vector-valued functions x˙:−τ2,−τ1⟶Rn. The following formula holds:(6)−τ2−τ1∫t−τ2t−τ1x˙TsWx˙sds≤−xt−τ1xt−τ2TW−W−WWxt−τ1xt−τ2.Lemma 2.
(Schur complement lemma). For symmetric matricesW=W1∗W12TW2, where W11 is n×n dimensional, “∗” is a symmetric term, and the following conditions are equivalent: W<0,W1<0,W2−W12TW1−1W12<0, W2<0,andW1−W12W2−1W12T<0.Lemma 3.
For the real matrixΘ>0,X and the given scalar δ, the following formula holds: δ2Θ−2δX≥−XΘ−1X.


## 2.1. LMI

The research on LMI (linear matrix inequalities) has been widespread. When it is used to solve control problems, LMI will be used to simplify the practical issues involved. Here are some definitions of LMI and many practical issues of LMI implementation used in later sections [23]. In general, the specific LMI, formula is(1)Gx=G0+x1G1+⋯+xmGm<0,where x1,x2,…,xm−1,xm.. is the measure decision variable of LMI. x=x1,x2⋯xm−1,xmT∈Rm is the decision vector Gi=GiT∈Rn×n,i=0,1,…,m is a symmetric matrix. Equation (1) is the general form of LMI, but through the exploration of scholars, most of the content of its solution is a variable matrix. If the following Lyapunov inequality(2)GX=XA+ATX+Q<0,where Q∈Rn×n is a real symmetric matrix, A∈Rn×n is a constantly fixed matrix, X∈Rn×n is an unknown solution matrix, so most of the contents of the LMI solution are variable matrices. Formulas (1) and (2) are two representations of LMI, but they embody the same essence. Therefore, the resolution of a kind of LMI problem [24] is obtained as follows: for the existing LMI Gx<0, we can use the function that comes with LMI to solve it, in which there is a function with special meaning, which can be used to test whether the existing x satisfies Gx<0. This kind of case is the LMI technique to solve the problem, and the solver in the function is expressed by feasp.


## 2.2.H∞ Control Theory

As the core part of robust control,H∞, the theory provides many analysis ideas for control systems and effective solutions for robustness exploration. It can realize the calculation of H∞ the norm. By optimizing this kind of function and then designing the controller reasonably within the prescribed constraint conditions, the robustness of the system becomes very good. The block diagram of H∞ control is shown in Figure 1.Figure 1
The structure of theH∞ problem.In addition,u is the output information of the controller, P is the controlled object, w is the external interference information, z is the information output of the object, y is the measured value, and K is the controller.System objects are considered as follows:(3)x˙t=A¯11xt+B¯11ut+B¯1wwt,zt=C¯22xt+D¯11wt+D¯12ut,yt=C¯33xt+D¯31wt+D¯32ut,where ut∈Rm is the input vector of the system, yt∈Rs is the measured output of the system, xt∈Rn denotes the state vector, zt∈Rq represents the control output of the system, and wt∈ℒ20,∞ represents the information of the disturbance signal. A¯11,D¯32,B¯11,B¯1w,C¯33,D¯21,C¯22,D¯11,D¯12 is a fixed constant matrix.For anyγ>0, if formula (3) contains the following properties:(1)
Ifwt=0, then the system is stable.(2)
If the functionΦs is used to represent the relationship between zt and wt by calculating the norm, we have(4)Φs∞=supw2≤1z2w2≤γ2.And, then it is equal to(5)∫0∞γ2wTtwtdt≥∫0∞zTtztdt,∀wt∈ℒ20,∞.Then, system (5) has H∞ performance γ [25].Formula (5) is the ability of anti-interference to the outside world, so γ is called the suppression system to the outside world. The smaller the value of γ is, the better the control performance of the system will be.


## 2.3. Some Lemmas

Lemma 1.
(Jensen inequality). For constant matricesW∈Rn×n,W=WT≥0, scalar 0≤τ1≤τ2, and vector-valued functions x˙:−τ2,−τ1⟶Rn. The following formula holds:(6)−τ2−τ1∫t−τ2t−τ1x˙TsWx˙sds≤−xt−τ1xt−τ2TW−W−WWxt−τ1xt−τ2.Lemma 2.
(Schur complement lemma). For symmetric matricesW=W1∗W12TW2, where W11 is n×n dimensional, “∗” is a symmetric term, and the following conditions are equivalent: W<0,W1<0,W2−W12TW1−1W12<0, W2<0,andW1−W12W2−1W12T<0.Lemma 3.
For the real matrixΘ>0,X and the given scalar δ, the following formula holds: δ2Θ−2δX≥−XΘ−1X.


## 3. Problem Description

In the current research results, most of the studies are completed under the assumption that the object can be measured. In the actual system, the information of the object cannot be measured directly, so the NCSs’ study of state feedback under the DoS attack of event-triggered mechanism cannot act on the system directly. Therefore, the NCSs’ research of output feedback under the DoS attack is critical.


### 3.1. System Description

The model of the system is as follows:(7)x˙at=Aa+ΔAatxat+Bau^t+Bwwt,yt=Caxat,zt=Ca1xat+Dau^t+Da1wt,xt0=x0,where u^t∈Rm is the input vector, xat∈Rn is the state vector, wt∈L20,∞ is the interference signal, yt∈Rq is the measured output, and Aa,Ba,Ca,Ca1,Da,Bw,Da1 is the constant matrix with appropriate dimension.ΔAat matrix is an uncertain matrix and must satisfy the condition of (8):(8)ΔAat=DFtE,where DandE is a fixed constant matrix and Ft is a time-varying unknown matrix with respect to time t is Lebesque and satisfies FTtFt≤I.To improve the anti-interference ability of the system in the network, save the limited network resources, and apply the network model attacked by DoS to the control system, the system structure block diagram is shown in Figure2.Figure 2
DoS attack NCS diagram of double-ended event triggering mechanism under output feedback.


### 3.2. Establishment of DoS Attack Model

Consider a general attack model that limits the actions of attackers only by limiting the frequency and duration of DoS attacks. It is a kind of periodic network interference signal with energy constraint in the form of pulse width modulation (PWM). Its specific expression is as follows:(9)PDost=0,t∈n−1T,n−1T+Toff,1,t∈n−1T+Toff,nT,where n∈N is a periodic natural number, T∈R>0 is an attack period, Toff∈R>0Toff<T is the zero boundary point of DoS attack and non-DoS attack, and Toffmin<Toff<T<∞. The interval of the network system that is not attacked by DoS is n−1T,n−1T+Toff, and the interval of the network system that is attacked by DoS is n−1T+Toff,nT.


### 3.3. Establish a Double-Ended Elastic Event Trigger Mechanism

In view of the situation that the controlled object cannot be measured directly, we propose a two-terminal elastic event trigger mechanism which depends on the information of the object and the controller, which can enhance the anti-interference ability of the system and reduce the amount of data transmitted in the network channel at the same time.The latest sensor trigger time is expressed bybkh, and bk+1h is used to indicate the next trigger time. If there is no DoS attack, the elastic trigger conditions on the sensor side are(10)bk+1h=bkh+minq∈Nqh|ybkh−ybkh+qhTWyybkh−ybkh+qh≤ξytyTbkhWyybkh,where ξyt is used to represent the threshold function and Wy>0 is used to represent the matrix that needs to be solved, and at the same time, it must satisfy(11)ξ˙yt=1ξyt1ξyt−δyybkh−ybkh+qhTWyybkh−ybkh+qh,where δy≥1 is the known constant, ybkh+qh the sampling state of the current time, and ybkh shows the latest state of the event trigger.If there is a DoS attack, the trigger condition of the sensor-side trigger will be defined as(12)bk,nh=bkq|bkq∈n−1T,n−1T+Toffmin∪nT.If the designed elastic event trigger satisfies condition (10) or (12) and the current state ybkh+qh is defined as the latest state ybk+1h, then it is sent to the network. dkh indicates the latest time of the controller, and dk+1h indicates the next trigger time. If there is no DoS attack, the elastic trigger conditions of the controller are as follows:(13)dk+1h=dkh+minq∈Nqh|udkh−udkh+qhTWuudkh−udkh+qh≤ξutuTdkhWuudkh.UsingWu>0 to express the matrix that needs to be solved, it must satisfy(14)ξ˙ut=1ξut1ξut−δuudkh−udkh+qhTWuudkh−udkh+qh.If there is a DoS attack, the event trigger conditions on the controller side need to be met as follows:(15)dk,nh=dkq|dkq∈n−1T,n−1T+Toffmin∪nT.


### 3.4. Establish the Model of Closed-Loop System

According to the study of timing and event mechanism in [25], we define λk,n=bk+1−bk−1. According to the duration of ZOH, it is finally divided into segments h:(16)tk,n,tk+1,nh=∪lk=0λk,nQk,nlk.In addition,t0,nh=n−1Th<Tandcn=supk∈N|tk,nh≤n−1T+Toffmin. For k∈cn,n∈N,λk,n=infm∈N|tk,nh+mh≥tk+1,nh≥nT:(17)C1,n=^n−1T,n−1T+Toff,ϑn=^0,1,…,kn,C2,n=^n−1T+Toff,nT,Qk,nlk=^tk,n,tk+1,nh,k∈ϑn,(18)Qk,nlk=tk,n,tk,n+hh,lk=0,tk,n+h,tk,n+2hh,lk=1,⋮tk,n+λk−1h,tk,n+λkhh,lk=λk−1,tk,n+λkh,tk+1,nh,lk=λk,(19)ϒkm=tk,nh+m−1h,tk,nh+mh,m=1,2,…,λk,n−1,ϒkλk,n=tk,nh+λk,n−1h,tk+1,nh,(20)C1,n=∪k=0knQk,nlk∩C1,n⊆∪k=0knQk,nlk.The combination of (18)–(20) can be described as follows:(21)C1,n=∪k=0kn∪m=1λk,nϒkm∩C1,n.Letψkm=ϒkm∩C1,n, i.e., C1,n=∪k=0kn∪m=1λk,nψkm.Define the function,ηt=t−bk,nh+lkh,t∈ψkm, i.e.,(22)ηt=t−bk,nh,t∈ψk1,t−bk.nh+h,t∈ψk2,⋮t−bk,nh+λkh,t∈ψkλk−1,where τ≤η1≤ηt≤η2=h+τ,η˙t=1,t∈ψkm.The set of real-time update times of the feedback forward channel zero-order holder will be expressed asτ,t1,n,t2,n,…, where tk,n=bk,nh+τ. According to the relevant properties of ZOH, the input information of output feedback is(23)y^t=ybk,nh,t∈tk,n,tk+1,nh.The control input of the controlled plant (7) is(24)u^t=ud¯k,nh,t∈ψkm.Several functions are defined as follows.(1)
Define the function:(25)eyt=ybk,nh−ybk,nh+lkh,t∈ψkm.According to formulas (22), (23), and (25), the controller inputs as(26)y^t=ybk,nh=eyt+yt−ηt,t∈ψkm.(2)
Define the function:(27)eut=ud¯k,nh−ubk,nh+lkh,t∈ψkm.According to formulas (22), (24), and (25), the control input of the controlled object (7) is(28)u^t=ud¯k,nh=eut+ut−ηt,t∈ψkm.The feedback controller for output dynamics is(29)x˙t=Acxct+Acdxct−ηt+Bcy^t,ut=Kxct,t∈ψkm,where y^t is the input vector of dynamic output feedback, ut is the output vector, and xct∈Rn matrix is the matrix with a proper dimension of the state vector Ac,Acd,K,Bc.In the same timing, the inputu^t of (29) is substituted into model (7), and the input y^t of (26) is brought into (29). The final closed-loop model is(30)ε˙t=A1εt+A12εt−ηt+B11eyt+B12eut+B¯wwt,zt=C¯a1εt+Daeut+DaKεt−ηt+Da1wt,t∈Qk,nlk∩C1,n,ε˙t=A1εt+A22εt−ηt+B11eyt+B¯wwt,zt=C¯a1εt+Da1wt,t∈C2,n.In order to facilitate the analysis, this chapter introduces the switching signal:(31)ψt=1,t∈−h,0∪∪n∈NC1,n,2,t∈∪n∈NC2,n.Forψt=i∈1,2 andn∈N, define(32)ti,n=n−1T,i=1,n−1T+Toffmin,i=2.LetCi,n=ti,n,t3−i,n+i−1,ψti,n=i,ψti,n−=3−i.Based on the set switching signalψt, the closed-loop system (30) can be simplified as follows:(33)ε˙ψtt=A1εt+Ai2εt−ηt+B11eyt+Bi2eut+B¯wwt,i∈1,2,t∈∪n∈Nti,n,t3−i,n+i−1,zt=C¯a1εt+Da1wt+Diaeut+DiaKεt−ηt,xt0=x0,where(34)D1a=Da,D2a=0,B22=0,C¯a1=Ca10,εt=xatxct,B¯w=Bw0,B11=0Bc,B12=Ba0,A1=Aa+ΔAat00Ac,A12=0BaKBcCaAcd,A22=00BcCaAcd.


## 3.1. System Description

The model of the system is as follows:(7)x˙at=Aa+ΔAatxat+Bau^t+Bwwt,yt=Caxat,zt=Ca1xat+Dau^t+Da1wt,xt0=x0,where u^t∈Rm is the input vector, xat∈Rn is the state vector, wt∈L20,∞ is the interference signal, yt∈Rq is the measured output, and Aa,Ba,Ca,Ca1,Da,Bw,Da1 is the constant matrix with appropriate dimension.ΔAat matrix is an uncertain matrix and must satisfy the condition of (8):(8)ΔAat=DFtE,where DandE is a fixed constant matrix and Ft is a time-varying unknown matrix with respect to time t is Lebesque and satisfies FTtFt≤I.To improve the anti-interference ability of the system in the network, save the limited network resources, and apply the network model attacked by DoS to the control system, the system structure block diagram is shown in Figure2.Figure 2
DoS attack NCS diagram of double-ended event triggering mechanism under output feedback.


## 3.2. Establishment of DoS Attack Model

Consider a general attack model that limits the actions of attackers only by limiting the frequency and duration of DoS attacks. It is a kind of periodic network interference signal with energy constraint in the form of pulse width modulation (PWM). Its specific expression is as follows:(9)PDost=0,t∈n−1T,n−1T+Toff,1,t∈n−1T+Toff,nT,where n∈N is a periodic natural number, T∈R>0 is an attack period, Toff∈R>0Toff<T is the zero boundary point of DoS attack and non-DoS attack, and Toffmin<Toff<T<∞. The interval of the network system that is not attacked by DoS is n−1T,n−1T+Toff, and the interval of the network system that is attacked by DoS is n−1T+Toff,nT.


## 3.3. Establish a Double-Ended Elastic Event Trigger Mechanism

In view of the situation that the controlled object cannot be measured directly, we propose a two-terminal elastic event trigger mechanism which depends on the information of the object and the controller, which can enhance the anti-interference ability of the system and reduce the amount of data transmitted in the network channel at the same time.The latest sensor trigger time is expressed bybkh, and bk+1h is used to indicate the next trigger time. If there is no DoS attack, the elastic trigger conditions on the sensor side are(10)bk+1h=bkh+minq∈Nqh|ybkh−ybkh+qhTWyybkh−ybkh+qh≤ξytyTbkhWyybkh,where ξyt is used to represent the threshold function and Wy>0 is used to represent the matrix that needs to be solved, and at the same time, it must satisfy(11)ξ˙yt=1ξyt1ξyt−δyybkh−ybkh+qhTWyybkh−ybkh+qh,where δy≥1 is the known constant, ybkh+qh the sampling state of the current time, and ybkh shows the latest state of the event trigger.If there is a DoS attack, the trigger condition of the sensor-side trigger will be defined as(12)bk,nh=bkq|bkq∈n−1T,n−1T+Toffmin∪nT.If the designed elastic event trigger satisfies condition (10) or (12) and the current state ybkh+qh is defined as the latest state ybk+1h, then it is sent to the network. dkh indicates the latest time of the controller, and dk+1h indicates the next trigger time. If there is no DoS attack, the elastic trigger conditions of the controller are as follows:(13)dk+1h=dkh+minq∈Nqh|udkh−udkh+qhTWuudkh−udkh+qh≤ξutuTdkhWuudkh.UsingWu>0 to express the matrix that needs to be solved, it must satisfy(14)ξ˙ut=1ξut1ξut−δuudkh−udkh+qhTWuudkh−udkh+qh.If there is a DoS attack, the event trigger conditions on the controller side need to be met as follows:(15)dk,nh=dkq|dkq∈n−1T,n−1T+Toffmin∪nT.


## 3.4. Establish the Model of Closed-Loop System

According to the study of timing and event mechanism in [25], we define λk,n=bk+1−bk−1. According to the duration of ZOH, it is finally divided into segments h:(16)tk,n,tk+1,nh=∪lk=0λk,nQk,nlk.In addition,t0,nh=n−1Th<Tandcn=supk∈N|tk,nh≤n−1T+Toffmin. For k∈cn,n∈N,λk,n=infm∈N|tk,nh+mh≥tk+1,nh≥nT:(17)C1,n=^n−1T,n−1T+Toff,ϑn=^0,1,…,kn,C2,n=^n−1T+Toff,nT,Qk,nlk=^tk,n,tk+1,nh,k∈ϑn,(18)Qk,nlk=tk,n,tk,n+hh,lk=0,tk,n+h,tk,n+2hh,lk=1,⋮tk,n+λk−1h,tk,n+λkhh,lk=λk−1,tk,n+λkh,tk+1,nh,lk=λk,(19)ϒkm=tk,nh+m−1h,tk,nh+mh,m=1,2,…,λk,n−1,ϒkλk,n=tk,nh+λk,n−1h,tk+1,nh,(20)C1,n=∪k=0knQk,nlk∩C1,n⊆∪k=0knQk,nlk.The combination of (18)–(20) can be described as follows:(21)C1,n=∪k=0kn∪m=1λk,nϒkm∩C1,n.Letψkm=ϒkm∩C1,n, i.e., C1,n=∪k=0kn∪m=1λk,nψkm.Define the function,ηt=t−bk,nh+lkh,t∈ψkm, i.e.,(22)ηt=t−bk,nh,t∈ψk1,t−bk.nh+h,t∈ψk2,⋮t−bk,nh+λkh,t∈ψkλk−1,where τ≤η1≤ηt≤η2=h+τ,η˙t=1,t∈ψkm.The set of real-time update times of the feedback forward channel zero-order holder will be expressed asτ,t1,n,t2,n,…, where tk,n=bk,nh+τ. According to the relevant properties of ZOH, the input information of output feedback is(23)y^t=ybk,nh,t∈tk,n,tk+1,nh.The control input of the controlled plant (7) is(24)u^t=ud¯k,nh,t∈ψkm.Several functions are defined as follows.(1)
Define the function:(25)eyt=ybk,nh−ybk,nh+lkh,t∈ψkm.According to formulas (22), (23), and (25), the controller inputs as(26)y^t=ybk,nh=eyt+yt−ηt,t∈ψkm.(2)
Define the function:(27)eut=ud¯k,nh−ubk,nh+lkh,t∈ψkm.According to formulas (22), (24), and (25), the control input of the controlled object (7) is(28)u^t=ud¯k,nh=eut+ut−ηt,t∈ψkm.The feedback controller for output dynamics is(29)x˙t=Acxct+Acdxct−ηt+Bcy^t,ut=Kxct,t∈ψkm,where y^t is the input vector of dynamic output feedback, ut is the output vector, and xct∈Rn matrix is the matrix with a proper dimension of the state vector Ac,Acd,K,Bc.In the same timing, the inputu^t of (29) is substituted into model (7), and the input y^t of (26) is brought into (29). The final closed-loop model is(30)ε˙t=A1εt+A12εt−ηt+B11eyt+B12eut+B¯wwt,zt=C¯a1εt+Daeut+DaKεt−ηt+Da1wt,t∈Qk,nlk∩C1,n,ε˙t=A1εt+A22εt−ηt+B11eyt+B¯wwt,zt=C¯a1εt+Da1wt,t∈C2,n.In order to facilitate the analysis, this chapter introduces the switching signal:(31)ψt=1,t∈−h,0∪∪n∈NC1,n,2,t∈∪n∈NC2,n.Forψt=i∈1,2 andn∈N, define(32)ti,n=n−1T,i=1,n−1T+Toffmin,i=2.LetCi,n=ti,n,t3−i,n+i−1,ψti,n=i,ψti,n−=3−i.Based on the set switching signalψt, the closed-loop system (30) can be simplified as follows:(33)ε˙ψtt=A1εt+Ai2εt−ηt+B11eyt+Bi2eut+B¯wwt,i∈1,2,t∈∪n∈Nti,n,t3−i,n+i−1,zt=C¯a1εt+Da1wt+Diaeut+DiaKεt−ηt,xt0=x0,where(34)D1a=Da,D2a=0,B22=0,C¯a1=Ca10,εt=xatxct,B¯w=Bw0,B11=0Bc,B12=Ba0,A1=Aa+ΔAat00Ac,A12=0BaKBcCaAcd,A22=00BcCaAcd.


## 4. Stability Analysis of Closed-Loop System

Through the LMI method and the related theory of Lyapunov, aiming at whether the networked control system is attacked by DoS or not in the unmeasurable state, based on the proposed two-terminal elastic event trigger mechanism, the exponential stability of the system is proved.Theorem 1.
For a given state gain matrixK and interference signal PDoSt (9), the parameters T and Toffminare known. Consider system (33), for the known positive scalar αi,h>0andγ>0 and the double-ended elastic event trigger parameter 0<δy<1and0<δu<1, if there is a positive definite matrix Wu,Wy,Pi,Qi,Ri,andZi and the matrix Mi,Ni,Si,i∈1,2, while satisfying the following conditions(35)∑i=Π11i∗∗∗∗∗hNiTϒ22i∗∗∗∗hSiT0ϒ33i∗∗∗hMiT00ϒ44i∗∗hRiA¯i000ϒ55i∗hZiA¯i0000ϒ66i<0,i=1,2,Π11i=Φi1+Φi+ΦiT,ϒ22i=ϒ33i=−e2−1iαiλihRi,ϒ44i=−e2−1iαiλihZi,λ1=1,λ2=0,ϒ55i=−Ri,ϒ66i=−Zi,then along the system trajectories (4)–(21), for any n∈N, there are(36)Vit≤e2−1iαit−ti,nViti,n,t∈ti,n,t3−i,n+i−1.Proof.
Select the following time-varying Lyapunov functions:(37)Vψtt=εTtPψtεt+∫t−htεTsexp•Qψtεsds+∫−h0∫t+θtε˙Tsexp•Zψtε˙sdsdθ+∫−h0∫t+θtε˙Tsexp•Rψtε˙sdsdθ+12ξy2t+12ξu2t.
WhenPψt>0,Rψt>0,Qψt>0,Zψt>0,αψt>0, and exp•=e2−1ψtαψtt−s are given, for any k∈ϑn,n∈N, when ψt=1, calculate the derivative V1t at t∈Qk,nlk∩C1,n:(38)V˙1t≤−2α1V1t+2α1εTtP1εt+2εTtP1ε˙t+εTtQ1εt−εTt−he−2α1hQ1εt−h+hε˙TtR1+Z1ε˙t−∫t−htε˙Tse−2α1hZ1ε˙sds−∫t−ηttε˙Tse−2α1hR1ε˙sds+2ε˜TtM1εt−εt−h−∫t−htε˙sds+2ε˜TtN1εt−εt−ηt−∫t−ηttε˙sds+2ε˜TtS1εt−ηt−εt−h−∫t−ht−ηtε˙sds−∫t−ht−ηtε˙Tse−2α1hR1ε˙sds+ξytξ˙yt+ξutξ˙ut,t∈Qk,nlk∩C1,n.
According to the literature [25], we can obtain(39)−2ε˜TtM1∫t−htε˙sds≤hε˜TtM1e2α1hZ1−1M1Tε˜t+∫t−htε˙Tse−2α1hZ1ε˙sds,(40)−2ε˜TtN1∫t−ηttε˙sds≤hε˜TtN1e2α1hR1−1N1Tε˜t+∫t−ηttε˙Tse−2α1hR1ε˙sds,(41)−2ε˜TtS1∫t−ht−ηtε˙sds≤hε˜TtS1e2α1hR1−1S1Tε˜t+∫t−ht−ηtε˙Tse−2α1hR1ε˙sds.
The simplified expressions of the two-terminal elastic event-triggering mechanisms (10)–(13) and trigger functions (23) and (28) can be obtained from the same time sequence ψkm of the input y^t of equation (23) and the object input u^t of (28):(42)1ξyteyTtWyeyt≤eyt+yt−ηtTWyeyt+yt−ηt,t∈Qk,nlk∩C1,n,(43)ξytξ˙yt=1ξyt−δyeyTtWyeyt=1ξyteyTtWyeyt−δyeyTtWyeyt≤eyt+yt−ηtTWyeyt+yt−ηt−δyeyTtWyeyt,t∈Qk,nlk∩C1,n,(44)1ξuteuTtWueut≤eut+ut−ηtTWueut+ut−ηt,t∈Qk,nlk∩C1,n,(45)ξutξ˙ut=1ξut−δueuTtWueut=1ξuteuTtWueut−δueuTtWueut≤eut+ut−ηtTWueut+ut−ηt−δueuTtWueut,t∈Qk,nlk∩C1,n.
Combining formulas (38)–(41), (43), and (45),(46)V˙1t≤−2α1V1t+χTtΠ1111+hN1e2α1hR1−1N1T+hM1e2α1hZ1−1M1T+hS1e2α1hR1−1S1T+hA¯1TR1+Z1A¯1χt,where χt=εt,εt−ηt,εt−h,eyt,eut,wt.
Apparently,(47)V˙1t=V˙1t+γ2wtwTt−γ2wtwTt−ztzTt+ztzTt.
zt of (29) in the closed-loop system is brought into (47) to obtain (48):(48)V˙1t≤−2α1V1t+χTtΠ111+hN1e2α1hR1−1N1T+hM1e2α1hZ1−1M1T+hS1e2α1hR1−1S1T+hA¯1TR1+Z1A¯1χt+γ2wTtwt−zTtzt,Φ11=P11∗∗∗∗∗A12TP1+KTDaTCa1H221∗∗∗∗00−e−2α1hQ1∗∗∗B11TP1WyCa0Wy−δyWy∗∗DaTCa1+B12TP1H5200H551∗B¯wTP1+Da1TCa1Da1TDaK00Da1TDaDa1TDa1−γ2,P11=P1A1+A1TP1+Q1+2α1P1+Ca1T∗Ca1,H551=−δuWu+Wu+DaTDa,Φ1=M1+N1−N1+S1−M1−S1000,A¯1=A1A120B11B12B¯w,H221=KTWuK+CaTWyCa+KTDaTDaK,H52=WuK+DaTDaK.
By using Shur Lemma, the following results are obtained:(49)Π111+hN1e2α1hR1−1N1T+hM1e2α1hZ1−1M1T+hS1e2α1hR1−1S1T+hA¯1TR1+Z1A¯1<0.
On the contrary, whent∈t2,n,t1,n+1, the same result is obtained:(50)V˙2t≤2α2V2t+χTtΠ112+hN2R2−1N2T+hM2Z2−1M2T+hS2R2−1S2T+hS2R2−1S2T+hA¯2TR2+Z2A¯2χt+γ2wTtwt−zTtzt,Φ21=P2A1+A1TP2+2α2P2+Q2+Ca1T∗Ca1∗∗∗∗∗A22TP2H222∗∗∗∗00−Q2∗∗∗B11TP2WyCa0Wy−δyWy∗∗0WuK00H552∗B¯wTP2+Da1TCa10000Da1TDa1−γ2,H222=KTWuK+CaTWyCa,H552=−δuWu+Wu,A¯2=A1A220B110B¯w,Φ2=M2+N2−N2+S2−M2−S2000.
According to the condition∑2<0, it is proved that it is completed if it satisfies V˙2t≤2α2V2t.Theorem 2.
For a given state gain matrixK and interference signal PDoSt (9), consider system (33), when the sequence satisfiesnTn∈N, and parameters T and Toffmin are known. For known positive scalars αi,μi,h>0andγ>0 and the trigger parameter 0<δy<1,0<δu<1, such as symmetric, positive, definite matrix, Wy,Wu,Pi,Qi,Ri,andZi, and matrix Mi,Ni,Si,i∈1,2. Both (35) and the following inequalities are satisfied:(51)Qi≤μ3−iQ3−i,P1≤μ2P2,Zi≤μ3−iZ3−i,P2≤μ1e2α1+α2hP1,Ri≤μ3−iR3−i,0<λ=−2α1+α2h+2α1Toffmin−Inμ1μ2−2α2T−Toffmin.The closed-loop system (33) under known periodic DoS interference attacks (9) is globally exponentially stable with a decay rate.According to the judgment basis of Theorems1 and 2, it is determined that the system is globally exponentially stable. However, there is a coupling relationship between the corresponding matrix Ac,Acd,K,Bc and Pi in formula (29), so the controller cannot be directly designed. Therefore, Section 5 is needed to design the controller further.


## 5. Design ofH∞ Dynamic Output Feedback Controller

Theorem 3.
For the given matrixK and pulse width interference signal PDoSt (9), the sequence nTn∈N and parameters T and Toffmin are known. Considering series (33), for the known positive scalar, αi,h>0,γ>0,γnn=1,2,3,4,5 and, double-ended elastic event trigger parameter, 0<δy<1and0<δu<1. If it exists in the positive definite matrix, Wu,Wy,P˜i,Q˜i,R˜i,Z˜i,X,andY and the matrix M˜i,N˜i,S˜i,i∈1,2, Z=X∗IY>0, which is satisfied at the same time:(52)Θ˜1=Π˜11i∗∗∗∗∗hN˜iTϒ˜22i∗∗∗∗hS˜iT0ϒ˜33i∗∗∗hM˜iT00ϒ˜44i∗∗hR˜iA˜i000ϒ˜55i∗hZ˜iA˜i0000ϒ˜66i<0,i=1,2.Then, the closed-loop system (33) is globally exponentially stable under the double-ended elastic event trigger mechanism (11) to (23). Also, the gain matrix of the output feedback controller (29) can be calculated as follows:(53)Ac=N−1Λ2−YAaXI−YX−1N,Bc=N−1Λ1,K=Λ3I−YX−1N,Acd=N−1Λ4−Λ1CaX−YBaΛ3I−YX−1N.Proof.
The matrixP is decomposed into(54)Pi=Y∗NTNTY−X−1−1N,i=1,2,using Lemma 1(55)Pi>0⇔Z=X∗IY>0⇔Y−X−1>0,X>0.
Define the matrix:(56)ϒ1=XIN−1I−YX0,ϒ2=Piϒ1=IY0NT,Ω=diagϒ1,ϒ1,ϒ1,ϒ1,I,I,ϒ2,ϒ2,ϒ2,ϒ2,ϒ2.
By usingΩ to perform the congruent transformation of the conditions in Theorem 1, the result is obtained:(57)Θ˜1=ΩTΘ1Ω<0,i=1,2,Θ˜1=Π˜11i∗∗∗∗∗hN˜iTϒ˜22i∗∗∗∗hS˜iT0ϒ˜33i∗∗∗hM˜iT00ϒ˜44i∗∗hR˜iA˜i000ϒ˜55i∗hZ˜iA˜i0000ϒ˜66i,Θ1=Π11i∗∗∗∗∗hNiTϒ22i∗∗∗∗hSiT0ϒ33i∗∗∗hMiT00ϒ44i∗∗hRiA¯i000ϒ55i∗hZiA¯i0000ϒ66i,Π˜11i=Φ˜i1+Φ˜i+Φ˜iT,ϒ˜22i=ϒ˜33i=−Ze2−1iαiλihR˜iZ,ϒ44i=−Ze2−1iαiλihZ˜iZ,λ1=1,λ2=0,Φ˜11=P˜11∗∗∗∗∗ϒ1TA12TP1ϒ1+ϒ1TKTDaTCa1ϒ1ϒ1TH221ϒ1∗∗∗∗00−e−2α1hQ˜1∗∗∗B11TP1ϒ1ϒ1TWyCaϒ10ϒ1TWy−δyWyϒ1∗∗DaTCa1ϒ1+B12TP1ϒ1H52ϒ100H551∗B¯wTP1ϒ1+Da1TCa1ϒ1Da1TDaKϒ100Da1TDaDa1TDa1−γ2,P˜11=ϒ1TP1A1+A1TP1+2α1P1+Ca1T∗Ca1ϒ1+Q˜1,ϒ˜55i=−R˜i,ϒ˜66i=−Z˜i,Z˜i=ϒ2TZiϒ2,Q˜i=ϒ1TQiϒ1,N˜i=ϒ2TNiϒ2,M˜i=ϒ2TMiϒ2,S˜i=ϒ2TSiϒ2,H551=δuWu+Wu+DaTDa,R˜i=ϒ2TRiϒ2,H221=KTWuK+CaTWyCa+KTDaTDaK,H52=WuK+DaTDaK,Φ˜i=M˜i+N˜i−N˜i+S˜i−M˜i−S˜i000,A˜1=A1A120B11B12B¯w,Φ˜21=P˜22∗∗∗∗∗ϒ1TA22TP2ϒ1ϒ1TH222ϒ1∗∗∗∗00−Q˜2∗∗∗B11TP2ϒ1ϒ1TWyCaϒ10ϒ1TWy−δyWyϒ1∗∗0WuKϒ100H552∗B¯wTP2ϒ1+Da1TCa1ϒ10000Da1TDa1−γ2,A˜2=A1A120B110B¯w,H552=−δuWu+Wu,H222=KTWuK+CaTWyCa,P˜22=ϒ1TP2A1+A1TP2+2α2P2+Ca1T∗Ca1ϒ1+Q˜2.
For conversions,(58)Λ1=NBc,Λ2=YAaX+NAcN−1I−YX,Λ3=KN−1I−YX,Λ4=Λ1CaX+YBaΛ3+NAcdN−1I−YX.
Applying Lemma3 to deal with the coupling term in ϒ˜22i,ϒ˜33i,andϒ˜44i, the result is obtained:(59)diagϒ˜22i,ϒ˜33i,ϒ˜44i=diagγ12R˜i−2γ1Z,γ22R˜i−2γ2Z,γ32Z˜i−2γ3Z.
The gain matrix of the controller with output feedback is(60)Ac=N−1Λ2−YAaXI−YX−1N,Bc=N−1Λ1,K=Λ3I−YX−1N,Acd=N−1Λ4−Λ1CaX−YBaΛ3I−YX−1N.
Because equation (59) contains an unknown matrix N, the gain Ac,Acd,K,Bc cannot be solved directly. Therefore, through the transformation of xct=N−1x¯ct, the equivalent of solution (29) is as follows:(61)x¯˙ct=A¯cx¯ct+D¯cx¯ct−ηt+B¯cy¯pt,ut=K¯xct,t∈ψkm.
The gain of the controller is expressed as follows:(62)A¯c=Λ2−YAaXI−YX−1,B¯c=Λ1,K¯=Λ3I−YX−1,A¯cd=Λ4−Λ1CaX−YBaΛ3I−YX−1.


## 6. Example Simulation

Considering the general satellite system model in [26, 27] as an example, the specific state-space model is described as (7), and the described matrix is given:(63)Aa=001.000000001.0000−0.280.28−0.00430.00430.28−0.280.0043−0.0043,ΔAa=100001000010/3000010/3,Ba=0010.2178T,Bw=0.10.10.10.1T,Ca=Ca1=1111,D=0.03000.0100.0300.01000.0300.010.0100.01,E=0.0100000.0100000.0100000.01.Because the eigenvalue of the system matrix isλ1=λ2=0,λ3=−0.0043−0.7843i,andλ4=−0.0043+0.7843i, the system is unstable without a controller.In the following, this paper jointly designs the event trigger parameterδy,Wy and δu,Wu and the control parameter form of the event trigger state feedback, and the closed-loop system (33) is exponentially stable in periodic DoS interference attack.Other parameter settings are as(64)miu1=miu2=1.3,α1=0.2,α2=0.3,h=0.01,δx=δu=0.2,T=3,Toffmin=2.76,gg=50,γn=3n=1,2,3,4,5u.By using Matlab, the parameters of the two-terminal elastic event trigger mechanism (10), (12), (13), and (15) and the gain matrix of the controller (53) can be obtained as follows:(65)K¯=−2.38511.0982−5.1571−4.5684,Wu=0.5605,Wy=0.2083∗∗∗0.10250.0814∗∗−0.0406−0.06385.6805∗−0.0463−0.04470.15610.0239,B¯c=−0.43280.19431.4566−0.4108,A¯c=0.8126∗∗∗−0.2207−0.1238∗∗0.3849−0.11343.0924∗1.42080.54361.08430.0191,D¯c=0.4418∗∗∗0.3056−1.0061∗∗−0.4158−0.1509−3.9104∗1.18450.48180.00450.0548.The internal initial condition system is givenx0=0.1−0.1−0.01−0.04T, and the simulation time is assumed to be 40s. The state graph of DoS attack NCS based on output feedback is shown in Figure 3. Obviously, the system can have good stability through Theorem 3.Figure 3
T=3andToffmin=2.76 state response curve under output feedback.Figures4 and 5 show the data trigger status of the controller and sensor side under the double-ended elastic event trigger mechanism designed in this chapter. The simulation results show that 120 data on the sensor side can meet the conditions of the elastic mechanism (10) and (12), and a total of 132 sampled data on the controller side meet the conditions of the elastic trigger mechanism (13) and (15).Figure 4
Trigger diagram of sensor side ofT=3andToffmin=2.76 under elastic trigger mechanism.Figure 5
Controller-side trigger diagram ofT=3andToffmin=2.76 under elastic trigger mechanism under output feedback.A total of 300 data are required to be sent to the network, and the trigger interval must be 0.1 s. Therefore, after using the method of output feedback, the sensor has 134 data that can meet the conditions of the event mechanism.As can be seen from Tables1 and 2, compared with the two-terminal elastic event mechanism and periodic trigger mechanism proposed in this section, it is found that the controller and the sensor side save 55.60% and 60.00% of resources, respectively, and the transmission cycle increases by 0.1273 s and 0.1400 s, respectively. Compared with the single-ended mechanism DoS attack in [28], the controller and sensor side save 4.67% and 55.60% resources, respectively, and the cycle changes are 0.0261 s and 0.1273 s, respectively. Therefore, the double-ended elastic event mechanism proposed in this section meets the performance requirements of the system very well, counteracts the known periodic DoS attacks, saves limited network resources, and improves the antijamming ability of the system.Table 1
Comparison diagram of output feedback data transmission rate under DoS attack based on event mechanism.
Event trigger mechanismSensor side (%)Controller side (%)Periodic trigger mechanism100100Single-ended event mechanism DoS attack in literature [28]44.67—The double-ended elastic mechanism DoS attack proposed in this chapter0.0044.40Table 2
Comparison diagram of sending cycle of output feedback data under DoS attack based on event mechanism.
Event trigger mechanismSensor side (s)Controller side (s)Periodic trigger mechanism1/101/10Single-ended event mechanism DoS attack in literature [28]0.22391/10The double-ended elastic mechanism DoS attack proposed in this chapter0.25000.2273In order to show the influence of the interference periodT, this section also solves the following optimization problems for the time interval of different T values [0, 40]:(66)Γoffmin=minToffmin|satisfy4−40.In order to verify the influence of event trigger parametersδx and δu on system stability, Tables 3 and 4 are obtained.Table 3
λ and ϖ come from different Toffmin.
Toffmin4.504.564.614.824.975.12λ0.36530.42530.47530.68530.83530.9853ϖ0.03040.03540.03960.05710.06960.0821Table 4
hmax and Toffmin come from different δx and δu.
δx=δu0.020.040.060.080.100.12hmax0.068360.068290.068250.068210.068160.06809Toffmin2.768772.768832.768892.768942.769002.76905To sum up, it can be concluded that (1) the system is stable; (2) the event trigger mechanism can reduce the traffic in the system; (3) the event-based output feedback controller does counteract the impact of periodic interference attacks.


## 7. Conclusion

Because the information of many objects cannot be directly monitored and there are DoS attacks in the network, this section studies the NCS under the output feedback of DoS attacks triggered by double-ended elastic events. First of all, this work proposes an elastic event trigger mechanism transmission scheme that depends on the information of the object and the controller, in order to reduce the burden of computing and communication and, at the same time, counteract the DoS interference attack imposed by the power-limited pulse width modulation (PWM) jammer. Secondly, based on the elastic event trigger mechanism and the DoS attack model, the closed-loop time-delay switching model of the system is established. Then, through LMI technology and Lyapunov knowledge, the stability criterion ofH∞ is obtained, which contains the relationship among elastic event trigger mechanism, DoS attack, stability, and delay, and the sufficient conditions of dynamic output feedback controller and elastic event mechanism are obtained. Finally, through a numerical example, it is proved that the double-ended elastic event trigger mechanism designed in this work can not only counteract the impact of DoS attack interference and save network resources but also can better ensure the performance of the system.



---

*Source: 6643034-2021-02-11.xml*