# An Overview of Recent Advances of Resilient Consensus for Multiagent Systems under Attacks

Authors: Muhammad Muzamil Aslam; Zahoor Ahmed; Liping Du; Muhammad Zohaib Hassan; Sajid Ali; Muhammad Nasir
Journal: Computational Intelligence and Neuroscience
 (2022)

---

## Abstract

Consensus control of multiagent systems (MASs) has been one of the most extensive research topics in the field of robotics and automation. The information sharing among the agents in the MASs depends upon the communication network because the interaction of agents may affect the consensus performance of the agents in a communication network. An unexpected fault and attack may occur on one agent and can propagate through the communication network into other agents. Thus, this may cause severe degradation of the whole MASs. In this paper, we first discussed MAS technologies. After that available technologies for the modeling of attacks and fundamental issues due to attacks on MAS attacks were discussed. We also introduced cooperative attack methodologies and model-based attack methodology. Objective of this article is to provide comprehensive study on recent advances in consensus control of MASs under attacks covering the published results until 2021. This survey presents different kinds of attacks, their estimation and detection, and resilient control against attacks. At the end, the survey accomplishes some potential recommendations for future direction to solve the key issues and challenges reported for secure consensus control of MASs.


---

## Body

## 1. Introduction

With advancement of communication and computer technologies, coordination control of MASs has got a lot of attention of researchers in different areas of engineering due to its broad applications in order to attain craving physical performances [1, 2]. There is speedy increment in progress of MASs because of improvement in communication, computing, and relevant technologies. MASs are also known as integration of communications, computations, physical processes, and controls which can play a key role in infrastructure [3, 4]. Cyber threats posture an actual and increasing problem, and to date, many countries struggle to counter them have lagged. However, capability to protect in contradiction of an attack or invasion must be upheld, and any country would be well served by discouraging its opponents from acting in the first place, at least when it comes to the most serious actions, namely, cyber warfare. There is vital role of cyber security in the era of technology also is biggest challenge to secure information in these days of technology. The first idea regarding cyber security in our mind is “cybercrime, cyber threat, or cyberattack”; those are increasing day by day. Several private and public sectors are taking various measures to secure such crimes, attacks, or threats.Due to variety of applications [4], MASs have become research interesting area. Despite usefulness, MASs have a lot of security risks because of the interconnections of various components and technologies. Since MASs are susceptible to spiteful threats and may result in the ailment of social life or loss of economic benefits. So, attack issues need considerable attention in the practical systems. In a smart transport system, an automatic controlled vehicle network can be a useful solution for an efficient and secure transport system and assists in problem-solving such as environmental protection, energy conservation, road congestion, and road accident. In contrast to the already present single-agent system, MASs are upgraded and scalable for enhancing energy efficiency and durability because they have the built-in ability for cooperative learning through the automatic decision. Recently, issues of MASs and their analysis have been well discussed in [5] but security issues of MASs have not been studied in the article and these systems are unsafe from cyberattacks and physical faults. So, we need to adjust, wait, or abandon at the time of system failure or attack [6]. MASs trust and access control issues have been highlighted. The researchers in [7, 8] highlighted MAS fault tolerant control procedure, and basic study was on reconfiguration way of topology. A very low-level attack or fault on an agent can disturb the system function and can cause damage to the system badly. Researchers have done wide research on cyber security and physical security in which detection and diagnosis, fault estimation problem, secure consensus, attack detection, and fault tolerant control were studied, and such research provides some basic methodologies and systematic suggestions for effective betterment of MASs security In Figure 1, there is framework of the intelligent transport system. Various kinds of attacks are present possible on the MASs such as man-in-middle attacks, deception attacks, cross-site scripting attacks, denial-of-service attacks, drive-by attacks, eavesdropping attacks, malware attacks, password attacks, phishing attacks, and SQL injection attacks.Figure 1
Intelligent transport system in coordination.In several fields of human activities, MASs have gained more attention, particularly the places where we need physical equipment, processes for control, and cooperating with the system and human, e.g., building automation networks, smart grids, and water sewerage plants. The progressing technologies, e.g., Industrial Internet or Industry 4.0 [9], are key points of MAS’s importance; this idea transition will involve increasing autonomy, automation, and fulfilling fresh arrival of the production. The main motivation which is forcing the development of MASs is the conjunction of physical process and computational aptitudes, and components of the process happening in the physical surrounding are requirements. MAS scaling, e.g., large and small, is differentiated by the number of components involved [5].These MASs are widely and geographically dispersed, heterogeneous, federated, and the critical system of life in which actuators and sensors are embedded networked for control physical world, monitoring, and sensing. There is no doubt that reserved scheduling via different own network or shared network plays a key role in the working of MAS. The selection of actuator or sensor for best performance of a specific action is an important decision, and also, proper management of actions is also important. Because of limited technology or physical constraints, there is risk of data transmission among network components, sensors, and actuators without any specific security instructions. In one point of view, interconnection of large scale of network components puts it in more complexity to save it from innate physical liabilities there. In another point of view, cyber integration generally sets up an underscore on protection and suppleness against threats and unseen from cyberspace [10, 11]. Hence, several new challenges are known to general or traditional control, software theory, and communication [12, 13].The susceptibility of MASs in cyber parts permits attacks into the system in nonproductive and silent approach, e.g., insertion of some virus or worm in network component computerization or layers that should have medium access, could cause coordination packets distraction. In addition, there can be prohibited access of attacker to the monitoring centers and gaining decryption key in gain of normal operation [3]. It is clear that when there is no strict security protection, the attacker can either freely harm system dynamic or bring any agitation. For solution of optimization problem in selection of input or output that highlights attacks with least detect ability and maximum impact; there is a survey [14].MAS consensus problem has been widely addressed [15, 16] with time delay. In MASs, we can found two types of delay, communication time delay (CTD) and input time delay (ITD). Here, CTD is linked between two agents interconnected time while ITD is related to data processing time. ITD may occur when controllers, actuators, or other components are linked to the network, while because of CTD, each agent may get information from a very near agent. CTD has been used in most real used applications such as computational and PWM delays in an LCL type grid-linked invertor and in controller area network bus of the distributed control network, induces delay. Here, we would like to discuss consensus problem of continuous time linear homogeneous MAS with CTD and ITD. ITD is considered multiple input time delays while CTD is single time delay. MAS consensus [14] problem has been widely studied from several studies, e.g., transportation control, coordinated defense system [17], power systems, and smart grids [18]. Consensus problem target is used to design a control law so that all agents can reach to a single point [14]. However, several present results on consensus problem were supposed as an ideal condition for investigation, e.g., secure network communication in between agents and unlimited resources network. In reality, there is presence of several impulsive issues, prime to a high security predicament and having influence on communication topology [14]. Nasty agents can grab this failing to interject communication between agents and disturb overall system stability in the multiagent network, while we can divide cyberattacks into the following cases on MASs, first is when there is an attack of nasty agent on agent and second is when nasty agent attacks to destroy the communication medium. In both cases, the communication graph is detached.There is no high-level protection against future MAS threats or attacks. There are several types of key challenges regarding MAS security, and these threats may be from the system inside such as sudden failure of the system, mobile networks security risks regarding human health, communication protocol weakness in smart grids, and limitations of physical systems. There is increasing requirement in new control system accuracy and reliability of each component. Any type of failure or fault of a system or component may lead to system performance degradation or reason for system instability or dramatic change in system operation [19].Because communication networks consist of interacting agents which require safety and reliability to gain cooperative control and given challenges which are absent in single-agent systems such as MAS interconnection properties confuse the fault detection and identification and make worldwide and exact fault information complicated to accommodate and gain. Faults can vary both network and agent behavior suddenly. Single-agent fault can effect throughout the communication network. There may occur multiple faults at various time intervals and places. However, such challenging problems can be studied in proper form. Multiple agent composition configuration can give better termination than a single-agent system. Other than this, throughout failure of component or an agent that is not possible to adjust for the single-agent system may be effectively controlled by use of cooperation in between network connection and agents.Inspired by the above study, practical and theoretical importance is given to review and classify some impressive MAS attacks (Figure5) and working (Figure 6) to give a complete survey, Figure 10 describes secure and control approaches of DoS attack, and Figure 2 shows present work and key challenges required for study. Furthermore, it is of both theoretical and practical significance to present a study for safety of MASs at one platform and also to provide comprehensive survey of recent advances of resilient consensus for MAS under attacks. To see latest MAS complexity, security problems and system security are highly important. Threats can be physical, cyber, or containing both sides of MAS, and it needs a composite method for mitigation and identification of safety weaknesses. In present research, the purpose was to study weakness, challenges, mitigation schemes, attack types supposing scalability complexity of MASs, and distributive and security and safety challenges. The remainder of the paper is organized as follows: in Section 2, we studied MAS technologies; in Section 3, we studied attack modeling and methodology; in Section 4, we briefly discussed fundamental issues of MASs; in Section 5, we discussed problem formation; in Section 6, there is comprehensive study on cooperative attack methodologies; in Section 7, there is discussion on model-based attack methodology, in Section 8, deception attack detection or identification has been studied; and in Section 9, there are briefly discussed key challenges. Similarly, Figure 2 represents flowchart of paper. Table 1 explains all notations used in the manuscript.Figure 2
Paper flowchart.Table 1
Explanation of notations.
Sr. noAbbreviationExplanation1MASMultiagent system2MASsMultiagent systems3SNSensor network4IoTInternet of Things5TCPTransmission control protocol6IPInternet protocol7NICVNetwork Interface card virtualization8DoSDenial-of-service9PCPersonal computer10LTILinear time-invariant11DDoSDistributed denial of service12MITMMan-in-the-middle13FDIFalse data injection14PLCProgrammable logic controller15SCADASupervisory control and data acquisition16M2MMachine to machine17SDNSoftware define network18EECDHEnhanced Elliptic Curve Differ-Hellman19WSNWireless sensor network20WLSWeighted least square21LQGLinear-quadratic-Gaussian22GTGame theory


## 2. MAS Supporting Technologies

Here, we study key technological improvements which are planned as well as links in between MAS and other basics which are studied to encourage technological developing chain that commanded the emergence of MASs. In several works, the concept such as smart object, embedded system, ubiquitous computing, smart environment, and sensor networks plays a key role in development of MASs. In case of time line, embedded systems are ancestors of all given knowledge appeared in the past and beginning fresh development in the field of microelectronics and replying critical problems such as remote control and automation. There is predefined functionality in embedded systems traversing across single or multiplied functions that are not easy to reprogram by the last user. The basic purpose of embedded systems was to control, design, and operate physical world process. Though, in beginning, embedded systems were closely compared to MAS or IoT, they were restricted by physical control function with the cyber space layer.Figure3 represents detailed general technologies supporting MASs. With the progress of technology and requirement to manage and control complicated systems, importance of the embedded system was clear and then there was an idea of the network embedded system. An important reason lacking down the availability of MAS was transition from one system to a connected system with more complexity. In view of this concept, sensor networks (SNs) strongly impact on the latest MAS. Actually, for information gathering, the SN contains a number of sensors deployed in specific place/areas. Presence of the SN eased improvements of smart objects, e.g., actuator or sensors containing microprocessor, power sources, and communication services. Thus, the SN cannot be supposed as freely unit, but as part of complicated systems. Fast development in modern computing systems containing MAS gave idea of ubiquitous computing. In addition, concept of computer system integration with daily activities enables them “unseen” for the last users. In some views, ubiquitous computing overlaps with other ideas, ambient intelligence, pervasive computing, and IoT. An important role of IoT is the establishment of capabilities for the last user to enhance present forms of everyday devices and improvement of private facilities by use of joined ubiquitous devices. It shows transition from the embedded system from predefined functionality to IoT and ubiquitous computing where an important need is adaptability and nimbleness. More and more improvements of computing systems run to presences of IoT and MAS. Actually, MAS is bit far from paradigm in which functional technologies are detached from information technologies to prototype where computational and physical elements are integrated. Although IoT has no specific definition, in some cases, IoT has been described as global infrastructure containing standard protocols and communication technologies that avail facilities given by “things” to diverse applications. In another case, IoT is a general term presenting the scenario types where smart objects are deployed, enabling worldwide communication through Internet or technologies. Hence, the concept of IoT is to represent the infrastructure of the devices worldwide. The scenario where worldwide connectivity is basic need, MAS is supposed to be in the first row of such systems that can join worldwide connectivity and can be distributed among enough units. Figure 4 shows MAS infrastructure.Figure 3
General technologies supporting MASs.Figure 4
MAS infrastructure.


### 2.1. MAS Infrastructure

In development of every system, there is an important role of infrastructure, the same spread on to MAS. In general, basic element of MAS is to be considered as actuator, sensor, communication network, and controller. An important thing is that MAS can be a close-loop or open-loop system. In way of IoT, the global network has access through open loop such as Big Data and cloud computing which are addition in infrastructure of MAS. Hence, MAS may contain a huge number of heterogeneous devices containing actuators, sensors, etc. In addition, it also has roughly limitations on MAS, communication technologies, for instance, and requirement of safety protocols. We can say that such heterogeneity is the main challenge in MAS, so different kinds of devices gain care from a system. To see challenges in big and small systems, among challenges, for example, unified integrity, mobility also affects the entire system. It represents that transferring of devices may cause various problems and need to be taken in regular working of the system. Infrastructure is complicated span because it consists of both hardware and software. MAS architecture is complicated summarizing cyber and physical space. MAS architecture has been studied in [20], contains five-layer MAS infrastructure. In [14], it has been studied four-level MAS architecture. If MAS needs to be in connection with worldwide/global networks, such as Internet, TCP/IP can be the best candidate in which two last layers, physical and data, accordingly are shown by the single level. Transport, network layers, and application form other three layers part. Explained categorization of physical threats in fault estimation, detection, and tolerant of MASs has been studied in Table 2.Table 2
Types of fault and work on fault estimation, fault detection, and fault tolerant.
Fault typeFault estimationFault detectionFault tolerantActuator fault[21][22][23, 24]Sensor fault[25, 26][27][28, 29]Actuator and sensor fault[25, 30][31, 32][19, 33, 34]


### 2.2. MAS Virtualization

In MAS, the basic purpose of virtualization is to abstract or hide complicated detail such as technical detail from above laying layers and to permit stretchy sharing resource, so that resources or working given as facilitation. So, MAS joints physical and cyber space and contains throughout process from signal to complexity of applications. There are some virtualization techniques such as network virtualization which is divided into subtypes such as router virtualization, network interface card virtualization (NICV), and link virtualization, application virtualization, and device virtualization.


### 2.3. Consensus Information

Suppose a decision-making agent network withx.i=ui attentive in accessing via local communication with nearby on G=V,E. By accessing consensus, it seems asymptotically joining to single-dimensional contract space characterized by(1)x1=x2=,…=xn.Such contract can be represented asx=α1 in which 1=1,…,1T and α∈ℝ is joined decision of all agents in the group. Suppose A=aij is adjacency matrix of G graph. Agent i set in nearby is Ni and represented as(2)Ni=j∈V:aij≠0;V=1,…,n,where i agent communicate with j agents which is neighbor of i. All set nodes and nearby agents represent E edge set of graph as E=i,j∈V×V:aij≠0. Gt=V,Et, and a dynamic graph is that where edges set Et and At adjacency matrix varying time. Nit nearby set in the dynamic graph of each agent is well. Such dynamic graphs are helping for explaining the mobile sensor technology network and flocks. The linear system is(3)x.it=∑j∈Niaijxjt−xit.It is a distributed consensus algorithm, and it follows that sum of state of all node is an invariant quantity. When applying this condition at timet=0 and t=∞, we get(4)α=1n∑ixi0,while in another way, if there is asymptotically access of consensus, then mandatory cooperative result is equal to initial state average of all nodes. With such variance characterization, the consensus algorithm is known as average consensus algorithm and has several applications in distributed computing on networks such as sensor fusion in the sensor network.In compact form, system dynamic can be represented as(5)x.=−Lx,where L = graph Laplacian G and it can be defines as(6)L=D−A,where D=diagd1,…,dn is degree matrix of G with zero off-diagonal elements.L has right eigenvector of 1 linked with zero eigenvalue because of the identity L1=0.


## 2.1. MAS Infrastructure

In development of every system, there is an important role of infrastructure, the same spread on to MAS. In general, basic element of MAS is to be considered as actuator, sensor, communication network, and controller. An important thing is that MAS can be a close-loop or open-loop system. In way of IoT, the global network has access through open loop such as Big Data and cloud computing which are addition in infrastructure of MAS. Hence, MAS may contain a huge number of heterogeneous devices containing actuators, sensors, etc. In addition, it also has roughly limitations on MAS, communication technologies, for instance, and requirement of safety protocols. We can say that such heterogeneity is the main challenge in MAS, so different kinds of devices gain care from a system. To see challenges in big and small systems, among challenges, for example, unified integrity, mobility also affects the entire system. It represents that transferring of devices may cause various problems and need to be taken in regular working of the system. Infrastructure is complicated span because it consists of both hardware and software. MAS architecture is complicated summarizing cyber and physical space. MAS architecture has been studied in [20], contains five-layer MAS infrastructure. In [14], it has been studied four-level MAS architecture. If MAS needs to be in connection with worldwide/global networks, such as Internet, TCP/IP can be the best candidate in which two last layers, physical and data, accordingly are shown by the single level. Transport, network layers, and application form other three layers part. Explained categorization of physical threats in fault estimation, detection, and tolerant of MASs has been studied in Table 2.Table 2
Types of fault and work on fault estimation, fault detection, and fault tolerant.
Fault typeFault estimationFault detectionFault tolerantActuator fault[21][22][23, 24]Sensor fault[25, 26][27][28, 29]Actuator and sensor fault[25, 30][31, 32][19, 33, 34]


## 2.2. MAS Virtualization

In MAS, the basic purpose of virtualization is to abstract or hide complicated detail such as technical detail from above laying layers and to permit stretchy sharing resource, so that resources or working given as facilitation. So, MAS joints physical and cyber space and contains throughout process from signal to complexity of applications. There are some virtualization techniques such as network virtualization which is divided into subtypes such as router virtualization, network interface card virtualization (NICV), and link virtualization, application virtualization, and device virtualization.


## 2.3. Consensus Information

Suppose a decision-making agent network withx.i=ui attentive in accessing via local communication with nearby on G=V,E. By accessing consensus, it seems asymptotically joining to single-dimensional contract space characterized by(1)x1=x2=,…=xn.Such contract can be represented asx=α1 in which 1=1,…,1T and α∈ℝ is joined decision of all agents in the group. Suppose A=aij is adjacency matrix of G graph. Agent i set in nearby is Ni and represented as(2)Ni=j∈V:aij≠0;V=1,…,n,where i agent communicate with j agents which is neighbor of i. All set nodes and nearby agents represent E edge set of graph as E=i,j∈V×V:aij≠0. Gt=V,Et, and a dynamic graph is that where edges set Et and At adjacency matrix varying time. Nit nearby set in the dynamic graph of each agent is well. Such dynamic graphs are helping for explaining the mobile sensor technology network and flocks. The linear system is(3)x.it=∑j∈Niaijxjt−xit.It is a distributed consensus algorithm, and it follows that sum of state of all node is an invariant quantity. When applying this condition at timet=0 and t=∞, we get(4)α=1n∑ixi0,while in another way, if there is asymptotically access of consensus, then mandatory cooperative result is equal to initial state average of all nodes. With such variance characterization, the consensus algorithm is known as average consensus algorithm and has several applications in distributed computing on networks such as sensor fusion in the sensor network.In compact form, system dynamic can be represented as(5)x.=−Lx,where L = graph Laplacian G and it can be defines as(6)L=D−A,where D=diagd1,…,dn is degree matrix of G with zero off-diagonal elements.L has right eigenvector of 1 linked with zero eigenvalue because of the identity L1=0.


## 3. Attack Modeling and Methodology

### 3.1. Approach of Modeling DoS Attack

We will study two important techniques for DoS attacks modeling in MASs: one is queueing technique and also another is stochastic technique.


#### 3.1.1. Queueing Technique

Like computers, firewalls and routers are considered networking devices, providing poor performance in supervision of DoS attacks, though trade with maximum rate because of memory resource constrains, interrupt processing, and input output processing and central processing units. However, packet loss and delay jitter are vastly affected under attack which can cause disturbance to the control system performance, e.g., mean squared error, rise and settling, and overshoot of percentage. The transmission of packet in the network control system under DoS attack is approached to smear simple techniques which are based on several input queues [35–37]. Two techniques are discussed as follows:(1)
DoS attack is launched by attackers to an endpoint from the system or PC to surrounding area nearby to endpoint. In this way, a huge number of packets are lost.(2)
DoS attack can be launched by attackers with the use of remote system to initial edged routers foremost to leisurely down network connection between controller and a remote plant.DoS is considered as singularity that can save control signal from required time preserved. It is done by single host. It shows that control and measurement channel may be provoked individually. Hence, it can be supposed that in the process of DoS attack, it seems complicated to receive or send data. Supposemj.j∈X0 in which m0>0, which is DoS 0/1 transition sequence; here, 0 is for “off” and 1 is for “on” situation, e.g., that time when DoS variation a transition from 0 to 1 and that time there is possibility of interruption of communication, so(7)Mj≜mjWmj,mj+ρj.Mj is representing time interval of jth DoS attack. That length may be ρj∈R≥0, this is the time when there is no communication, consider ρn=0, and here, jth DoS attack is shown as individual pulse at mj time. An input is generated by an actuator which is based on fresh received controller data through DoS attack. Given ρ,φ∈R≥0withφ≥ρ, suppose that(8)∴ρ,φ≜∐j∈X0Mj∏ρ,φ,°ρφ≜ρφ∴ρφ.It represents that at each intervalρ,φ,∴ρ,φ, °ρ,φ and ρ,φ are representing to time instants set, when communication is permitted and stopped, respectively. Applying control signal to all ρ∈R≥0, it can be written as(9)wρ=PQρPρ,wρ=PQρPρ.It shows that for allρj∈R≥0.Pρ modern fruitful control approach, the same to proposed techniques is used in [38]. In concluded form, we can say that there is disadvantage of this start and end of approach is not found and is most useful to post records.


#### 3.1.2. Stochastic Technique

Generally, cyberattacks are performed when the system is weak to detect the threat and results in security defilement. In practice, such attacks are introduced by the series of actions to compare security services such as confidentiality, integrity, and availability of MAS applications such as telecommunication, military, banking, smart power grids, and transportation systems. To trace the threats and cyberattacks such as file-less malware, advance persistent threat, and zero days, CPS has become focus of interest. Other than this, a number of techniques were introduced to predict cyberattacks against MAS, in which several techniques have been developed using a stochastic approach such as Hawkes process model, Markov chain model, negative binomial distribution model, and Poisson model. In the fast-growing trend of CPS attacks, attacks are considered to be launched externally against MASs within a given amount of time and using stochastic distribution models such as Bernoulli model [38, 39] and Markov model [40]; from the LTI system, the Bernoulli model can be seen:(10)YP+1=BYP+μPAWP+uP,FP=γPHQP+hp.For the Markov model, we supposed the following:(11)YP+1=BQP+μδP+1AWP+uP,FP=HQP+hP.From (6), hp = measurement noise and uP = process noise.These measurement noise and process noise are commonly known as independent and identically distributed. Here, with 0 mean Gaussian random vector and covarianceQ, μP,γP are independent identically distributed. Bernoulli is relevant to existence of DoS attack on measurement and process noises [41].Now, see (7).μðP+1∈0,1 is known as Markov controlled DoS attack sequence which stops transmitting of control signal packets to actuator in which ðP is similar to interior state of attacker [42].


## 3.1. Approach of Modeling DoS Attack

We will study two important techniques for DoS attacks modeling in MASs: one is queueing technique and also another is stochastic technique.


### 3.1.1. Queueing Technique

Like computers, firewalls and routers are considered networking devices, providing poor performance in supervision of DoS attacks, though trade with maximum rate because of memory resource constrains, interrupt processing, and input output processing and central processing units. However, packet loss and delay jitter are vastly affected under attack which can cause disturbance to the control system performance, e.g., mean squared error, rise and settling, and overshoot of percentage. The transmission of packet in the network control system under DoS attack is approached to smear simple techniques which are based on several input queues [35–37]. Two techniques are discussed as follows:(1)
DoS attack is launched by attackers to an endpoint from the system or PC to surrounding area nearby to endpoint. In this way, a huge number of packets are lost.(2)
DoS attack can be launched by attackers with the use of remote system to initial edged routers foremost to leisurely down network connection between controller and a remote plant.DoS is considered as singularity that can save control signal from required time preserved. It is done by single host. It shows that control and measurement channel may be provoked individually. Hence, it can be supposed that in the process of DoS attack, it seems complicated to receive or send data. Supposemj.j∈X0 in which m0>0, which is DoS 0/1 transition sequence; here, 0 is for “off” and 1 is for “on” situation, e.g., that time when DoS variation a transition from 0 to 1 and that time there is possibility of interruption of communication, so(7)Mj≜mjWmj,mj+ρj.Mj is representing time interval of jth DoS attack. That length may be ρj∈R≥0, this is the time when there is no communication, consider ρn=0, and here, jth DoS attack is shown as individual pulse at mj time. An input is generated by an actuator which is based on fresh received controller data through DoS attack. Given ρ,φ∈R≥0withφ≥ρ, suppose that(8)∴ρ,φ≜∐j∈X0Mj∏ρ,φ,°ρφ≜ρφ∴ρφ.It represents that at each intervalρ,φ,∴ρ,φ, °ρ,φ and ρ,φ are representing to time instants set, when communication is permitted and stopped, respectively. Applying control signal to all ρ∈R≥0, it can be written as(9)wρ=PQρPρ,wρ=PQρPρ.It shows that for allρj∈R≥0.Pρ modern fruitful control approach, the same to proposed techniques is used in [38]. In concluded form, we can say that there is disadvantage of this start and end of approach is not found and is most useful to post records.


### 3.1.2. Stochastic Technique

Generally, cyberattacks are performed when the system is weak to detect the threat and results in security defilement. In practice, such attacks are introduced by the series of actions to compare security services such as confidentiality, integrity, and availability of MAS applications such as telecommunication, military, banking, smart power grids, and transportation systems. To trace the threats and cyberattacks such as file-less malware, advance persistent threat, and zero days, CPS has become focus of interest. Other than this, a number of techniques were introduced to predict cyberattacks against MAS, in which several techniques have been developed using a stochastic approach such as Hawkes process model, Markov chain model, negative binomial distribution model, and Poisson model. In the fast-growing trend of CPS attacks, attacks are considered to be launched externally against MASs within a given amount of time and using stochastic distribution models such as Bernoulli model [38, 39] and Markov model [40]; from the LTI system, the Bernoulli model can be seen:(10)YP+1=BYP+μPAWP+uP,FP=γPHQP+hp.For the Markov model, we supposed the following:(11)YP+1=BQP+μδP+1AWP+uP,FP=HQP+hP.From (6), hp = measurement noise and uP = process noise.These measurement noise and process noise are commonly known as independent and identically distributed. Here, with 0 mean Gaussian random vector and covarianceQ, μP,γP are independent identically distributed. Bernoulli is relevant to existence of DoS attack on measurement and process noises [41].Now, see (7).μðP+1∈0,1 is known as Markov controlled DoS attack sequence which stops transmitting of control signal packets to actuator in which ðP is similar to interior state of attacker [42].


## 3.1.1. Queueing Technique

Like computers, firewalls and routers are considered networking devices, providing poor performance in supervision of DoS attacks, though trade with maximum rate because of memory resource constrains, interrupt processing, and input output processing and central processing units. However, packet loss and delay jitter are vastly affected under attack which can cause disturbance to the control system performance, e.g., mean squared error, rise and settling, and overshoot of percentage. The transmission of packet in the network control system under DoS attack is approached to smear simple techniques which are based on several input queues [35–37]. Two techniques are discussed as follows:(1)
DoS attack is launched by attackers to an endpoint from the system or PC to surrounding area nearby to endpoint. In this way, a huge number of packets are lost.(2)
DoS attack can be launched by attackers with the use of remote system to initial edged routers foremost to leisurely down network connection between controller and a remote plant.DoS is considered as singularity that can save control signal from required time preserved. It is done by single host. It shows that control and measurement channel may be provoked individually. Hence, it can be supposed that in the process of DoS attack, it seems complicated to receive or send data. Supposemj.j∈X0 in which m0>0, which is DoS 0/1 transition sequence; here, 0 is for “off” and 1 is for “on” situation, e.g., that time when DoS variation a transition from 0 to 1 and that time there is possibility of interruption of communication, so(7)Mj≜mjWmj,mj+ρj.Mj is representing time interval of jth DoS attack. That length may be ρj∈R≥0, this is the time when there is no communication, consider ρn=0, and here, jth DoS attack is shown as individual pulse at mj time. An input is generated by an actuator which is based on fresh received controller data through DoS attack. Given ρ,φ∈R≥0withφ≥ρ, suppose that(8)∴ρ,φ≜∐j∈X0Mj∏ρ,φ,°ρφ≜ρφ∴ρφ.It represents that at each intervalρ,φ,∴ρ,φ, °ρ,φ and ρ,φ are representing to time instants set, when communication is permitted and stopped, respectively. Applying control signal to all ρ∈R≥0, it can be written as(9)wρ=PQρPρ,wρ=PQρPρ.It shows that for allρj∈R≥0.Pρ modern fruitful control approach, the same to proposed techniques is used in [38]. In concluded form, we can say that there is disadvantage of this start and end of approach is not found and is most useful to post records.


## 3.1.2. Stochastic Technique

Generally, cyberattacks are performed when the system is weak to detect the threat and results in security defilement. In practice, such attacks are introduced by the series of actions to compare security services such as confidentiality, integrity, and availability of MAS applications such as telecommunication, military, banking, smart power grids, and transportation systems. To trace the threats and cyberattacks such as file-less malware, advance persistent threat, and zero days, CPS has become focus of interest. Other than this, a number of techniques were introduced to predict cyberattacks against MAS, in which several techniques have been developed using a stochastic approach such as Hawkes process model, Markov chain model, negative binomial distribution model, and Poisson model. In the fast-growing trend of CPS attacks, attacks are considered to be launched externally against MASs within a given amount of time and using stochastic distribution models such as Bernoulli model [38, 39] and Markov model [40]; from the LTI system, the Bernoulli model can be seen:(10)YP+1=BYP+μPAWP+uP,FP=γPHQP+hp.For the Markov model, we supposed the following:(11)YP+1=BQP+μδP+1AWP+uP,FP=HQP+hP.From (6), hp = measurement noise and uP = process noise.These measurement noise and process noise are commonly known as independent and identically distributed. Here, with 0 mean Gaussian random vector and covarianceQ, μP,γP are independent identically distributed. Bernoulli is relevant to existence of DoS attack on measurement and process noises [41].Now, see (7).μðP+1∈0,1 is known as Markov controlled DoS attack sequence which stops transmitting of control signal packets to actuator in which ðP is similar to interior state of attacker [42].


## 4. Fundamental Issues of Multiagent Systems

Basic purpose of MAS classification is to explain overview and fundamental issues regarding cyberattacks. Some general examples of cyberattacks are distributed denial of service (DDoS), man-in-the-middle (MITM), deception attack, password attack, and malware attack. Cyberattack is an offensive action, while if there is possibility of occurring of attacks, then it is known as cyber threat, while cyber risk is interconnected with the word threat which estimates the probability of proportional loss which may occur. Figure5 shows basic types and subtypes of security attacks.Figure 5
Types/subtypes of MAS security attacks.Here, we will discuss few cyberattacks and fundamental issues discussed in latest research. Figure6 shows working of MAS security attacks.Figure 6
Working of DoS attacks.


### 4.1. Deception Attack

There is hastily emerging phenomenon of use of deception technology in contemporary cyber security as a feasible means active and intelligent postbreach defense. Similar to any unruly technology it happens with fallacies. Cyber security needs to be changed from being dependent on largely detecting untrue things within a cloud of healthy activity to being focused on stopping cybercrime, which tends to tempt, phish, deceive, and trap users. Deception tactic often proves to be healthy for defense and attack. Deception technology has progressed far yonder the honeypot perception. Now a day’s deception is being active in baiting and luring attackers to a deception environment. Deception, also known as malicious attacks and false data injection (FDI) attacks, is defined and studied in [9, 43–45], e.g., nominated malicious system Stuxnet which is able to be reprogrammed and running code in PLCs in SCADA system cause aberration from required conduct. In power grids, transmission system adversaries can send attack to hack remote terminal units, e.g., in substations, there are sensors [12]. For another example of such kind of attack, see study [14, 46, 47]. Deception changes cyber security by providing sole breadcrumbs and traps for industry specific environment, legacy system, IoT, and devices where low cost regularly excludes security structures. Authors in [48] considered measurement output to encounter deception attack based on Bernoulli distribution during signal transmission. To describe random property of deception attack, Bernoulli distribution has been deployed [14]. Deception attack has been used in the term of limited time boundness [14].


### 4.2. DoS Attack

Denial-of-service (DoS) attack denies or makes slow to the authentic users to access a resource web, e.g., emails and network. DoS attack is policies, and those are usually used for profession of communication capitals in order to forbid the measurement transmission and cause supreme possible worsening of performance of the system. The common DoS model has been studied in [49] in which DoS topographies are discussed with DoS duration and DoS frequency. Similarly, improvement in this idea has been studied for production with the output controller of dynamic feedback.Complicated form of DoS is distributed denial of service (DDoS) [50, 51] which is also known as coordinated attack, where a huge number of cooperated machines work to achieve DoS attack [52]. However, because it can be easily created, so DDoS is easily available, has high impact and low cost of systems, consisting ability of fully detach an association [53]. It is represented that there is instability of power grids because of attacks and could give long delay jitter on network control system packets. The division of DoS attack in radio frequency identification is because of the reasons studied in [54, 55], e.g., desynchronization attack, system jamming, kill command attack, tag data modification, and random DoS attack as shown in Figure 5.In conclusion of this DoS attack, aforementioned forms of DoS attacks are implemented for the classification of DoS attack in radio frequency identification systems as studied in [29, 54, 56]. Therefore, they could be present in many forms of MASs.


### 4.3. Jamming Attack

Such DoS attack refers to condition when one channel is occupied by an attacker for prevention of other node from its use which causes blocking of communication. For obtaining optimal defense mechanism for the network control system, stochastic game theory is applied [29, 57, 58]. Dynamic collaboration among attackers and sensor transmitters in the network control system was projected as the double-player stochastic game. In stochastic game, cost functions contain source cost used for conduction of attack actions, cyber-layer defense, and as possible harmed dynamic act of the network control system. Interaction effect between defender and attacker on dynamic concert of the network control system was supposed by the following cost function. Finally, a stochastic dynamic programming delinquent has been explained for gaining optimal defense mechanism.In [59–61], security in remote state approximation of MASs has been studied. Communication between remote approximator and sensor node was taken through wireless channel that may be attacked by a jamming attacker. Best decision of process making of both attacking and communicating was discussed in case of consideration of energy constrains for both attacker and the sensor. Markov theory was used for gaining equivalent solutions, and constrained relax delinquent was designed.For maximization of linear quadratic Gaussian used optimal jamming attack, it controls cost function while supposed energy constraints studied in [59, 60, 62]. Corresponding cost and optimal jamming agenda were consequent after studying the usage of cost function under a free attack agenda. The fresh analytically model was studied in the influence of attack jamming on broadcasting. A jamming attack for optimal energy efficient by wireless channel under jammer attacker energy constraints is studied in [63].These attacks forced by power constrained pulse width-modulated jammers are supposed to be moderately recognized, which is jammer period and unchanging inferior destined and jammers asleep periods are identified. Controller synthesis problem that is an event based for network control systems and strong event triggered communication scheme was studied in [27]. In conclusion, piecewise Lyapunov function is applied to guarantee exponential stability of the system.


### 4.4. Man-in-the-Middle (MITM) Attack

Generally name “man in the middle” is derived from a game scenario known as basketball, where two players aim to throw a ball to each other, and one of them tries to clutch it [64]. MITM is well-known computer security attack, which gives a great challenge to security professional. Actually, it hits real data flowing between confidentiality, endpoint, and integrity of the data. For analyzing and categorizing the MITM scope, researchers should read [65] survey.Basically, MITM takes benefit of authentication protocol weakness used by communication networks. Usually, the third party is responsible for authentication that issues certificates because the system of certificate production becomes another way of solid weakness. MITM attacks permits unauthorized parties to snoop data by backdoor.


#### 4.4.1. Example of MITM Attack

About in 2015 [66], it was known that Lenovo machines are available with already installed adware known as superfish which injects adds on browser such as Internet Explorer and Google Chrome. Superfish installs a compiled certificate into Windows certificate database. It leaves all secure stock layer (SSL) certificates given by Hypertext transfer protocol secure (HTTPS) that are linked with personal certificates. Such situation may provide an access to hackers to receive sensitive information such as bank account information, transactions, or user lifestyle..Internet of Things (IoT) is progressing from smart home to smart cities and making our lives dependent. With the passage of time, billions of M2M will be interconnect with each other, and the big problem is to manage such a big problem for network administrator. Intensive-security methods, classical computing method as antivirus, and encryption are not directly installed software. With network infrastructure, it is compulsory to make IoT devices more secure.Opposite to the traditional security network, software define network (SDN) [63] gives several new features, as centralized control and network programmer, which skilled the owner to manage network automatic in a dynamic and flexible way. We can see that IoT future [67] is SDN dependent. Open floe channels security issues of IoT, e.g., MITM, are studied in [68].Distributed methodology for agent network permission targeted for execution of the distributed algorithm to control MITM attack is studied in [69, 70] which intends steering algorithm result towards erratic values of risky configurations. An example of MITM attack is shown in Figure 7.Figure 7
Victim with and without attack.
(a)(b)Figure7(a) shows victims without attackers, and Figure 7(b) shows victims with attacker, contenting message between A and B without notice.


#### 4.4.2. Key Points

There are following key points of MITM:(1)
MITM permits hackers to intercept confidential data.(2)
MITM is session hijacking type.(3)
MITM permits hackers to insert malicious data and sites in form misty from genuine data.(4)
MITM exploits real-time nature of data transfer and communication to go hidden.(5)
MITM contains hackers inserting themselves as proxies or relays in an ongoing data transfer or appropriate conversation.Researchers can study the following literature for their research interest of MITM attack [71–73].


#### 4.4.3. EECDH Prevention Technique

Enhanced Elliptic Curve Differ-Hellman (EECDH) prevention technique for MITM attack is well studied in current research [45] which improves the security level. Keep secure MITM attack where communication carrier clears themselves before cooperating their keys, to use Differ-Hellman key exchange for communal verification, so that during cloud sharing, data privacy sustained.


### 4.5. Replay Attack

Such kind of deception attack happened when adversary succeed in recording some of the transmission data, e.g., in MAS, sensing data are injected [74, 75]. This form of attack is supposed to happen in two ways, e.g., in 1st way of Figure 7 recording data of attacker from system and injecting the same data in the system, and another way is attack could be outside carrying that subject to physical systems represented in Figure 8 [76]. Likewise, an attacker formed communication connection in between two last points to enclosure observed messages in various areas in globe generally present in WSN [77]. In designing, such attack could be assumed as changeable delays with unidentified data on variable rates and upper bounds. Applying time-delay system concept jointly by optimization methods acceptable max upper bound can be premeditated [3].Figure 8
First and second phase of replay attack.
(a)(b)There is no requirement of system information in such form of attack, containing information on designed estimator and controllers; for detection, this activity makes it complicated. Adopting counters and time-stamp in the transmitted data is solution opposite to such attack. Two phases, first and second of replay attack, has been shown in 8.There is not enough research that studies controlling of MASs subject to replay attacks, e.g., recording vista control variation direct to replay attack is discussed in [78], which gives an explicit and simple connection in between computing, attacking horizons, and infinite-horizon cost. Then, asymptotic exponential stability of the system is ensured by availing enough condition set; see one more example study [74, 79]. Feasibility terms of replay attack and countermeasure suggestions those enhance the possibility of detection by supposing control performance are discussed in [80]. And integrity attack on the control system is countermeasured and analyzed proficient of showing these attacks were not assumed. For further example of such attack, we can see [79, 81, 82].


## 4.1. Deception Attack

There is hastily emerging phenomenon of use of deception technology in contemporary cyber security as a feasible means active and intelligent postbreach defense. Similar to any unruly technology it happens with fallacies. Cyber security needs to be changed from being dependent on largely detecting untrue things within a cloud of healthy activity to being focused on stopping cybercrime, which tends to tempt, phish, deceive, and trap users. Deception tactic often proves to be healthy for defense and attack. Deception technology has progressed far yonder the honeypot perception. Now a day’s deception is being active in baiting and luring attackers to a deception environment. Deception, also known as malicious attacks and false data injection (FDI) attacks, is defined and studied in [9, 43–45], e.g., nominated malicious system Stuxnet which is able to be reprogrammed and running code in PLCs in SCADA system cause aberration from required conduct. In power grids, transmission system adversaries can send attack to hack remote terminal units, e.g., in substations, there are sensors [12]. For another example of such kind of attack, see study [14, 46, 47]. Deception changes cyber security by providing sole breadcrumbs and traps for industry specific environment, legacy system, IoT, and devices where low cost regularly excludes security structures. Authors in [48] considered measurement output to encounter deception attack based on Bernoulli distribution during signal transmission. To describe random property of deception attack, Bernoulli distribution has been deployed [14]. Deception attack has been used in the term of limited time boundness [14].


## 4.2. DoS Attack

Denial-of-service (DoS) attack denies or makes slow to the authentic users to access a resource web, e.g., emails and network. DoS attack is policies, and those are usually used for profession of communication capitals in order to forbid the measurement transmission and cause supreme possible worsening of performance of the system. The common DoS model has been studied in [49] in which DoS topographies are discussed with DoS duration and DoS frequency. Similarly, improvement in this idea has been studied for production with the output controller of dynamic feedback.Complicated form of DoS is distributed denial of service (DDoS) [50, 51] which is also known as coordinated attack, where a huge number of cooperated machines work to achieve DoS attack [52]. However, because it can be easily created, so DDoS is easily available, has high impact and low cost of systems, consisting ability of fully detach an association [53]. It is represented that there is instability of power grids because of attacks and could give long delay jitter on network control system packets. The division of DoS attack in radio frequency identification is because of the reasons studied in [54, 55], e.g., desynchronization attack, system jamming, kill command attack, tag data modification, and random DoS attack as shown in Figure 5.In conclusion of this DoS attack, aforementioned forms of DoS attacks are implemented for the classification of DoS attack in radio frequency identification systems as studied in [29, 54, 56]. Therefore, they could be present in many forms of MASs.


## 4.3. Jamming Attack

Such DoS attack refers to condition when one channel is occupied by an attacker for prevention of other node from its use which causes blocking of communication. For obtaining optimal defense mechanism for the network control system, stochastic game theory is applied [29, 57, 58]. Dynamic collaboration among attackers and sensor transmitters in the network control system was projected as the double-player stochastic game. In stochastic game, cost functions contain source cost used for conduction of attack actions, cyber-layer defense, and as possible harmed dynamic act of the network control system. Interaction effect between defender and attacker on dynamic concert of the network control system was supposed by the following cost function. Finally, a stochastic dynamic programming delinquent has been explained for gaining optimal defense mechanism.In [59–61], security in remote state approximation of MASs has been studied. Communication between remote approximator and sensor node was taken through wireless channel that may be attacked by a jamming attacker. Best decision of process making of both attacking and communicating was discussed in case of consideration of energy constrains for both attacker and the sensor. Markov theory was used for gaining equivalent solutions, and constrained relax delinquent was designed.For maximization of linear quadratic Gaussian used optimal jamming attack, it controls cost function while supposed energy constraints studied in [59, 60, 62]. Corresponding cost and optimal jamming agenda were consequent after studying the usage of cost function under a free attack agenda. The fresh analytically model was studied in the influence of attack jamming on broadcasting. A jamming attack for optimal energy efficient by wireless channel under jammer attacker energy constraints is studied in [63].These attacks forced by power constrained pulse width-modulated jammers are supposed to be moderately recognized, which is jammer period and unchanging inferior destined and jammers asleep periods are identified. Controller synthesis problem that is an event based for network control systems and strong event triggered communication scheme was studied in [27]. In conclusion, piecewise Lyapunov function is applied to guarantee exponential stability of the system.


## 4.4. Man-in-the-Middle (MITM) Attack

Generally name “man in the middle” is derived from a game scenario known as basketball, where two players aim to throw a ball to each other, and one of them tries to clutch it [64]. MITM is well-known computer security attack, which gives a great challenge to security professional. Actually, it hits real data flowing between confidentiality, endpoint, and integrity of the data. For analyzing and categorizing the MITM scope, researchers should read [65] survey.Basically, MITM takes benefit of authentication protocol weakness used by communication networks. Usually, the third party is responsible for authentication that issues certificates because the system of certificate production becomes another way of solid weakness. MITM attacks permits unauthorized parties to snoop data by backdoor.


### 4.4.1. Example of MITM Attack

About in 2015 [66], it was known that Lenovo machines are available with already installed adware known as superfish which injects adds on browser such as Internet Explorer and Google Chrome. Superfish installs a compiled certificate into Windows certificate database. It leaves all secure stock layer (SSL) certificates given by Hypertext transfer protocol secure (HTTPS) that are linked with personal certificates. Such situation may provide an access to hackers to receive sensitive information such as bank account information, transactions, or user lifestyle..Internet of Things (IoT) is progressing from smart home to smart cities and making our lives dependent. With the passage of time, billions of M2M will be interconnect with each other, and the big problem is to manage such a big problem for network administrator. Intensive-security methods, classical computing method as antivirus, and encryption are not directly installed software. With network infrastructure, it is compulsory to make IoT devices more secure.Opposite to the traditional security network, software define network (SDN) [63] gives several new features, as centralized control and network programmer, which skilled the owner to manage network automatic in a dynamic and flexible way. We can see that IoT future [67] is SDN dependent. Open floe channels security issues of IoT, e.g., MITM, are studied in [68].Distributed methodology for agent network permission targeted for execution of the distributed algorithm to control MITM attack is studied in [69, 70] which intends steering algorithm result towards erratic values of risky configurations. An example of MITM attack is shown in Figure 7.Figure 7
Victim with and without attack.
(a)(b)Figure7(a) shows victims without attackers, and Figure 7(b) shows victims with attacker, contenting message between A and B without notice.


### 4.4.2. Key Points

There are following key points of MITM:(1)
MITM permits hackers to intercept confidential data.(2)
MITM is session hijacking type.(3)
MITM permits hackers to insert malicious data and sites in form misty from genuine data.(4)
MITM exploits real-time nature of data transfer and communication to go hidden.(5)
MITM contains hackers inserting themselves as proxies or relays in an ongoing data transfer or appropriate conversation.Researchers can study the following literature for their research interest of MITM attack [71–73].


### 4.4.3. EECDH Prevention Technique

Enhanced Elliptic Curve Differ-Hellman (EECDH) prevention technique for MITM attack is well studied in current research [45] which improves the security level. Keep secure MITM attack where communication carrier clears themselves before cooperating their keys, to use Differ-Hellman key exchange for communal verification, so that during cloud sharing, data privacy sustained.


## 4.4.1. Example of MITM Attack

About in 2015 [66], it was known that Lenovo machines are available with already installed adware known as superfish which injects adds on browser such as Internet Explorer and Google Chrome. Superfish installs a compiled certificate into Windows certificate database. It leaves all secure stock layer (SSL) certificates given by Hypertext transfer protocol secure (HTTPS) that are linked with personal certificates. Such situation may provide an access to hackers to receive sensitive information such as bank account information, transactions, or user lifestyle..Internet of Things (IoT) is progressing from smart home to smart cities and making our lives dependent. With the passage of time, billions of M2M will be interconnect with each other, and the big problem is to manage such a big problem for network administrator. Intensive-security methods, classical computing method as antivirus, and encryption are not directly installed software. With network infrastructure, it is compulsory to make IoT devices more secure.Opposite to the traditional security network, software define network (SDN) [63] gives several new features, as centralized control and network programmer, which skilled the owner to manage network automatic in a dynamic and flexible way. We can see that IoT future [67] is SDN dependent. Open floe channels security issues of IoT, e.g., MITM, are studied in [68].Distributed methodology for agent network permission targeted for execution of the distributed algorithm to control MITM attack is studied in [69, 70] which intends steering algorithm result towards erratic values of risky configurations. An example of MITM attack is shown in Figure 7.Figure 7
Victim with and without attack.
(a)(b)Figure7(a) shows victims without attackers, and Figure 7(b) shows victims with attacker, contenting message between A and B without notice.


## 4.4.2. Key Points

There are following key points of MITM:(1)
MITM permits hackers to intercept confidential data.(2)
MITM is session hijacking type.(3)
MITM permits hackers to insert malicious data and sites in form misty from genuine data.(4)
MITM exploits real-time nature of data transfer and communication to go hidden.(5)
MITM contains hackers inserting themselves as proxies or relays in an ongoing data transfer or appropriate conversation.Researchers can study the following literature for their research interest of MITM attack [71–73].


## 4.4.3. EECDH Prevention Technique

Enhanced Elliptic Curve Differ-Hellman (EECDH) prevention technique for MITM attack is well studied in current research [45] which improves the security level. Keep secure MITM attack where communication carrier clears themselves before cooperating their keys, to use Differ-Hellman key exchange for communal verification, so that during cloud sharing, data privacy sustained.


## 4.5. Replay Attack

Such kind of deception attack happened when adversary succeed in recording some of the transmission data, e.g., in MAS, sensing data are injected [74, 75]. This form of attack is supposed to happen in two ways, e.g., in 1st way of Figure 7 recording data of attacker from system and injecting the same data in the system, and another way is attack could be outside carrying that subject to physical systems represented in Figure 8 [76]. Likewise, an attacker formed communication connection in between two last points to enclosure observed messages in various areas in globe generally present in WSN [77]. In designing, such attack could be assumed as changeable delays with unidentified data on variable rates and upper bounds. Applying time-delay system concept jointly by optimization methods acceptable max upper bound can be premeditated [3].Figure 8
First and second phase of replay attack.
(a)(b)There is no requirement of system information in such form of attack, containing information on designed estimator and controllers; for detection, this activity makes it complicated. Adopting counters and time-stamp in the transmitted data is solution opposite to such attack. Two phases, first and second of replay attack, has been shown in 8.There is not enough research that studies controlling of MASs subject to replay attacks, e.g., recording vista control variation direct to replay attack is discussed in [78], which gives an explicit and simple connection in between computing, attacking horizons, and infinite-horizon cost. Then, asymptotic exponential stability of the system is ensured by availing enough condition set; see one more example study [74, 79]. Feasibility terms of replay attack and countermeasure suggestions those enhance the possibility of detection by supposing control performance are discussed in [80]. And integrity attack on the control system is countermeasured and analyzed proficient of showing these attacks were not assumed. For further example of such attack, we can see [79, 81, 82].


## 5. Agents Communication, Faults, and Simulation Environment for Agent-Based MAS Network

In this section, we will study MAS agent communication, faults, and simulation environment.


### 5.1. MAS Agent Communication

We know that MAS contains self-directed agent group which works in cooperation with each other through other communication medium to gain considered goals, and find number of usage in different areas such as physics, biology, mathematics, social science, and computer engineering.Since 1962 [83], agent’s communication has been studied. Mainly used communication approaches are message passing, speech act, and blackboard. In message passing, agents directly message each other as shown in Figure 9(a). There is use of broadcast or point to point agent communication to communicate with other agents. In the broadcast communication, one agent sends message to all nearby agents while in former agent one can directly talk to another agent in case of other agent address information.Figure 9
An overview on communication approaches in MAS.
(a)(b)In speech act, researchers in [84] studied that some sentences or utterance verbs are act as speech acts that vary physical environment such as in general environment if general person uses sentence that “I now make you man and wife” such kind of sentence have impact on physical environment by introducing new condition and rule. Agent action can be as a speaker, which produces utterance to vary listener belief [84, 85].In blackboard communication, agents share data with each other in collaboration by use of central repository known as blackboard, Figure9(b). In this, data of each agent are stored in blackboard which are accessible and readable by other agents. Blackboard uses control information for controlling agent’s access. It is important for message semantics that need to confirm communicating agents with each other who have the same understanding of exchanged data. Sometimes in heterogeneous agents, it can be a challenging task.


### 5.2. MAS Agent Communication Faults

Basically, for MAS, two kinds of faults are considered known as network fault and agent fault. Network fault occurs in the communication network and may disturb communication performance while agent fault that can occur in internal components of actuators, agents, and sensors. There are three types of classification of agent’s faults, sensors faults, agents fault, and actuator fault which may affect agent dynamic.


### 5.3. Simulation Environment for Agent-Based MAS Network

Here, we are studying various evaluations and modeling methods used for metrics performance that differ depends upon task and MAS application of the considered agent-based system in comparison with state of the art. There are three basic evaluation methods, MATLAB, Java agent development framework, and GAMA.Using MATLAB, we study MAS performance, especially with mathematical complex environment. In addition, it is adjustable to Java agent development framework for more work on MAS performance.Java agent development framework is mostly used among simulators in MAS. Its admiration stalks from following properties. It benefits from third-party libraries and also is Java based. It is also written on foundation of intelligent physical agent’s standard. For designing MAS, it has graphical interface. It supports simulation distributed systems, is open source, and can link to Matlab, and also it skins complexity of MAS.Third, GAMA is simulation and modeling platform for agent-based system development. There are some advantages of GAMA such as it supports widely level MAS that contains a huge number of agents, it is useful for simulation purpose of any kind of MAS application, and it supports intuitive agent-based language such as GAML.Studied simulation methods are specifically for MAS, while because of large-level usage, specific evaluation methods are used for system analyzing in particular application and can be deployed for agent-based system simulation performance to see issues in that application.This is an important method which is usually used in the deception attack in sensor networks which contains the hypothesis test with predefined probabilities of binary hypothesis [86, 87]. Cooperative spectrum sensing performance limit is evaluated subject to Byzantine attacks; however, false data affect the fusion center, because of that output of wrong sensor increased [88, 89]. On binary hypothesis, a similar ratio detector is considered to manage with already determined fixed error for security of smart grid in sensor network data [20, 87, 90], energy frame work that is deep learning based, and block chain based is well studied in [20, 89]. A detector based on progressed similar has been studied in [91–93] and supposed for unobservable and observable circumstances in the SCADA system. An example of such methods has been applied in [94]. Important hypothesis applied is that all node transmitted packets are arbitrary; by this way, probability of next packet will not affect in verdict a packet to be nasty. In conclusion, there can be several forms of attacks those can affect single or several packets. For calculation of trust values, it is to be considered that node is transferring “X” packets; here, j packets are supposed to be normal. Observation of x(X) = j distribution is studied by given binomial distribution:(12)KxX=j|K=XjKj1−kX−j.Here,K shows that ith packet probability is normal k(K) = no. of normal packets this model intends to guess the probability of KWX+1=1|xX=j and result out either the X+1 packet is in normal form. With the use of Bayesian theorem, the following probability distribution is calculated:(13)KWX+1=1xX,=j=KWX+1=1xX=jKxN=j.Here, we can apply marginal probability distribution:(14)kxX=j=∫01kxX=p|kgk.vk,KWX+1=1,xX=j=∫01KxX=j|kgkk.vk.There are no data fork; now, it is considered that it can be found by uniform prior distribution gk=1; here, k∈0,1. Hence, we can rewrite above equations (12)–(14) as(15)KWX+1=1,xX=j=∫01KxX=j|kgkk.vk∫01kxX=p|kgk.vk,=p+1X+2.In resultant from equation (15), both of normal packets number j and X which is whole packets can be found in WSN, after the collection of traffic information. By applying suitable threshold, we can find malicious node. Some numerical results of such malicious nodes has been studied in [92, 95]. With the use of this model, we can find malicious node.


### 5.4. Weighted Least Square (WLS) Approach

It is an effectual consistent attack detection method for dimension data. Mostly, it is applied in power systems and smart grids [96–99]. By comparison of predefined threshold and constructed measurement residual, we carried out a bad resultant.Suppose(16)r=MY+c.Here,M=mabi∗j is known as measurement Jacobian matrix with full column rank, when j>x, m and r are considered states vector and measurement, respectively, and c is system noise effecting. Estimated delinquent is used to solve the m∗ of variable m, which is better for measurement of meter r w.r.t equation (10). Estimated measurement r∗ and observed measurement have a difference that is defined as z=r−r∗=r−MY∗. WLS problem is to find an estimate m∗ which slow the index performance DY∗, which can be found by the given formula:(17)miny∗DY∗≔r−MY∗ZUr−MY∗.In this weight matrix,U≔∑−1.To simulate1st order optimal situation, DY∗ is studied in [43]:(18)y∗MZUM≔Cr,where “C” is pseudoinverse of M and CM = 1.


### 5.5.Q2 Detector Kalman Filters

Here, we used characteristics of Kalman filter residual instead of WLS, to make it feasible for good or bad data:(19)Qp+1=BQp+Abp+up,Fp=HQp+hp.In this,bp∈Rk,Qp∈RkandFp∈Rj are the control input, state variable, and system measurements, respectively; hp≈∇0,Randup∈Rk are measurement noise and process noise, respectively. We can calculate Qp/p∗ with the use of given Kalman filter:(20)N0|−1∗=N0∗,K0|−1=ε,Qp+1∗=BQp+Abp,Kp+1|p=BKpBZ+S,Pp=Kp|p−1HZ+R−1,Qp∗=Kp|p−1+PpFp−HQp|p−1∗,Kp=Kp|p−1−PpHKp|p−1.It has been known that Kalman filter exists inFi−HQi|i−1∗ for equation (19), with LQG controller, and Kalman filter is Gaussian independent identically distributed [22]. Suppose(21)ep≔∑i=p−T+1pFi−CQi|i−1∗Zσ−1Fi−CQi|i−1∗.Here,ep = has an Q2 distribution among jT independent degree in normal operation which shows the lower probability of greater ep. T is window size. Here,(22)ep>M1<M0ρ.where M0 represents null hypothesis, M1 represents under attack hypothesis, ρ represents threshold discussed in [100, 101] used for the SCADA system, and the same results have been shown in [102]. Q2 detector with cosine has been explained in [95, 103, 104] for the detection of false data injection attacks which affects smart grid. An algorithm is discussed for the detection of deception attack in an application which could be remote state application, smart sensors used for data receiving [105]. Second application of such kind has been studied for the detection of bias injection attacks for stochastic rectilinear dynamical scheme [12, 106–109]. Multiclass support vector machine was discussed for building an intrusion detection model.


### 5.6. Quasi Fault Detection and Isolation Techniques (FDI)

FDI is famous and widely used in the networked control system. It identifies the fault presence, location, and fault type because it contains the monitoring system. This technique is helpful in detection of exterior attack in MASs. Attacks were supposed as unidentified inputs which effects both of states and measurements [110–113]. Using graph theory, undetectable attacks were characterized and also with the use of distributed and centralized monitor have been planned for the detection of distinguishing attacks. Based on geometric approach, a fault detection method has been implemented for detection of cyberattacks and fault in power systems or networks [114, 115]. The common system was applied for the detection of deception attacks and sensor actuator [44, 114]. Likewise, a model diagnosis system and free-fall detection were studied for designing cyberattack detector for the distribution system of water [26]. For detection and differentiation of both cyberattacks and fault, an intelligent generalized predictive controller was intended [25, 116]. Cyberattack can be targeted by recognized weakness in the system, which is weak point of FDI, different from losers commonly arbitrary or random. For designing the required robust system, this technique needs cautious investigation in order. In conclusion, it is important because of highly study, which lot of research has been done on for detection of cyber security in power systems, e.g., [117–120].


#### 5.6.1. Argument

Bayesian detection with binary hypothesis has been broadly studied and pragmatic in sensor network data fusion [23, 121,122]. In meaning of state approximation, there is need of system noise in a stochastic framework for the attack detection method, because it allows a probabilistic state approximation [64, 123]. Hence, there is need to smear mean and variance for state disruption distribution shown as freely variables. Providing of confident state approximation is important in many present applications, e.g., system guidance and navigation, target tracking, and attack [64, 123]. In short, modeling the state distributions in some sets supposed to be unidentified, but limited noises are more suitable. Therefore, ℵ2 is mostly useful based on holding discrepancies in approximation conduct which forecast by a model. Resultant unidentified but limited sounds are suboptimal, and attack detection feasibility is reduced.


## 5.1. MAS Agent Communication

We know that MAS contains self-directed agent group which works in cooperation with each other through other communication medium to gain considered goals, and find number of usage in different areas such as physics, biology, mathematics, social science, and computer engineering.Since 1962 [83], agent’s communication has been studied. Mainly used communication approaches are message passing, speech act, and blackboard. In message passing, agents directly message each other as shown in Figure 9(a). There is use of broadcast or point to point agent communication to communicate with other agents. In the broadcast communication, one agent sends message to all nearby agents while in former agent one can directly talk to another agent in case of other agent address information.Figure 9
An overview on communication approaches in MAS.
(a)(b)In speech act, researchers in [84] studied that some sentences or utterance verbs are act as speech acts that vary physical environment such as in general environment if general person uses sentence that “I now make you man and wife” such kind of sentence have impact on physical environment by introducing new condition and rule. Agent action can be as a speaker, which produces utterance to vary listener belief [84, 85].In blackboard communication, agents share data with each other in collaboration by use of central repository known as blackboard, Figure9(b). In this, data of each agent are stored in blackboard which are accessible and readable by other agents. Blackboard uses control information for controlling agent’s access. It is important for message semantics that need to confirm communicating agents with each other who have the same understanding of exchanged data. Sometimes in heterogeneous agents, it can be a challenging task.


## 5.2. MAS Agent Communication Faults

Basically, for MAS, two kinds of faults are considered known as network fault and agent fault. Network fault occurs in the communication network and may disturb communication performance while agent fault that can occur in internal components of actuators, agents, and sensors. There are three types of classification of agent’s faults, sensors faults, agents fault, and actuator fault which may affect agent dynamic.


## 5.3. Simulation Environment for Agent-Based MAS Network

Here, we are studying various evaluations and modeling methods used for metrics performance that differ depends upon task and MAS application of the considered agent-based system in comparison with state of the art. There are three basic evaluation methods, MATLAB, Java agent development framework, and GAMA.Using MATLAB, we study MAS performance, especially with mathematical complex environment. In addition, it is adjustable to Java agent development framework for more work on MAS performance.Java agent development framework is mostly used among simulators in MAS. Its admiration stalks from following properties. It benefits from third-party libraries and also is Java based. It is also written on foundation of intelligent physical agent’s standard. For designing MAS, it has graphical interface. It supports simulation distributed systems, is open source, and can link to Matlab, and also it skins complexity of MAS.Third, GAMA is simulation and modeling platform for agent-based system development. There are some advantages of GAMA such as it supports widely level MAS that contains a huge number of agents, it is useful for simulation purpose of any kind of MAS application, and it supports intuitive agent-based language such as GAML.Studied simulation methods are specifically for MAS, while because of large-level usage, specific evaluation methods are used for system analyzing in particular application and can be deployed for agent-based system simulation performance to see issues in that application.This is an important method which is usually used in the deception attack in sensor networks which contains the hypothesis test with predefined probabilities of binary hypothesis [86, 87]. Cooperative spectrum sensing performance limit is evaluated subject to Byzantine attacks; however, false data affect the fusion center, because of that output of wrong sensor increased [88, 89]. On binary hypothesis, a similar ratio detector is considered to manage with already determined fixed error for security of smart grid in sensor network data [20, 87, 90], energy frame work that is deep learning based, and block chain based is well studied in [20, 89]. A detector based on progressed similar has been studied in [91–93] and supposed for unobservable and observable circumstances in the SCADA system. An example of such methods has been applied in [94]. Important hypothesis applied is that all node transmitted packets are arbitrary; by this way, probability of next packet will not affect in verdict a packet to be nasty. In conclusion, there can be several forms of attacks those can affect single or several packets. For calculation of trust values, it is to be considered that node is transferring “X” packets; here, j packets are supposed to be normal. Observation of x(X) = j distribution is studied by given binomial distribution:(12)KxX=j|K=XjKj1−kX−j.Here,K shows that ith packet probability is normal k(K) = no. of normal packets this model intends to guess the probability of KWX+1=1|xX=j and result out either the X+1 packet is in normal form. With the use of Bayesian theorem, the following probability distribution is calculated:(13)KWX+1=1xX,=j=KWX+1=1xX=jKxN=j.Here, we can apply marginal probability distribution:(14)kxX=j=∫01kxX=p|kgk.vk,KWX+1=1,xX=j=∫01KxX=j|kgkk.vk.There are no data fork; now, it is considered that it can be found by uniform prior distribution gk=1; here, k∈0,1. Hence, we can rewrite above equations (12)–(14) as(15)KWX+1=1,xX=j=∫01KxX=j|kgkk.vk∫01kxX=p|kgk.vk,=p+1X+2.In resultant from equation (15), both of normal packets number j and X which is whole packets can be found in WSN, after the collection of traffic information. By applying suitable threshold, we can find malicious node. Some numerical results of such malicious nodes has been studied in [92, 95]. With the use of this model, we can find malicious node.


## 5.4. Weighted Least Square (WLS) Approach

It is an effectual consistent attack detection method for dimension data. Mostly, it is applied in power systems and smart grids [96–99]. By comparison of predefined threshold and constructed measurement residual, we carried out a bad resultant.Suppose(16)r=MY+c.Here,M=mabi∗j is known as measurement Jacobian matrix with full column rank, when j>x, m and r are considered states vector and measurement, respectively, and c is system noise effecting. Estimated delinquent is used to solve the m∗ of variable m, which is better for measurement of meter r w.r.t equation (10). Estimated measurement r∗ and observed measurement have a difference that is defined as z=r−r∗=r−MY∗. WLS problem is to find an estimate m∗ which slow the index performance DY∗, which can be found by the given formula:(17)miny∗DY∗≔r−MY∗ZUr−MY∗.In this weight matrix,U≔∑−1.To simulate1st order optimal situation, DY∗ is studied in [43]:(18)y∗MZUM≔Cr,where “C” is pseudoinverse of M and CM = 1.


## 5.5.Q2 Detector Kalman Filters

Here, we used characteristics of Kalman filter residual instead of WLS, to make it feasible for good or bad data:(19)Qp+1=BQp+Abp+up,Fp=HQp+hp.In this,bp∈Rk,Qp∈RkandFp∈Rj are the control input, state variable, and system measurements, respectively; hp≈∇0,Randup∈Rk are measurement noise and process noise, respectively. We can calculate Qp/p∗ with the use of given Kalman filter:(20)N0|−1∗=N0∗,K0|−1=ε,Qp+1∗=BQp+Abp,Kp+1|p=BKpBZ+S,Pp=Kp|p−1HZ+R−1,Qp∗=Kp|p−1+PpFp−HQp|p−1∗,Kp=Kp|p−1−PpHKp|p−1.It has been known that Kalman filter exists inFi−HQi|i−1∗ for equation (19), with LQG controller, and Kalman filter is Gaussian independent identically distributed [22]. Suppose(21)ep≔∑i=p−T+1pFi−CQi|i−1∗Zσ−1Fi−CQi|i−1∗.Here,ep = has an Q2 distribution among jT independent degree in normal operation which shows the lower probability of greater ep. T is window size. Here,(22)ep>M1<M0ρ.where M0 represents null hypothesis, M1 represents under attack hypothesis, ρ represents threshold discussed in [100, 101] used for the SCADA system, and the same results have been shown in [102]. Q2 detector with cosine has been explained in [95, 103, 104] for the detection of false data injection attacks which affects smart grid. An algorithm is discussed for the detection of deception attack in an application which could be remote state application, smart sensors used for data receiving [105]. Second application of such kind has been studied for the detection of bias injection attacks for stochastic rectilinear dynamical scheme [12, 106–109]. Multiclass support vector machine was discussed for building an intrusion detection model.


## 5.6. Quasi Fault Detection and Isolation Techniques (FDI)

FDI is famous and widely used in the networked control system. It identifies the fault presence, location, and fault type because it contains the monitoring system. This technique is helpful in detection of exterior attack in MASs. Attacks were supposed as unidentified inputs which effects both of states and measurements [110–113]. Using graph theory, undetectable attacks were characterized and also with the use of distributed and centralized monitor have been planned for the detection of distinguishing attacks. Based on geometric approach, a fault detection method has been implemented for detection of cyberattacks and fault in power systems or networks [114, 115]. The common system was applied for the detection of deception attacks and sensor actuator [44, 114]. Likewise, a model diagnosis system and free-fall detection were studied for designing cyberattack detector for the distribution system of water [26]. For detection and differentiation of both cyberattacks and fault, an intelligent generalized predictive controller was intended [25, 116]. Cyberattack can be targeted by recognized weakness in the system, which is weak point of FDI, different from losers commonly arbitrary or random. For designing the required robust system, this technique needs cautious investigation in order. In conclusion, it is important because of highly study, which lot of research has been done on for detection of cyber security in power systems, e.g., [117–120].


### 5.6.1. Argument

Bayesian detection with binary hypothesis has been broadly studied and pragmatic in sensor network data fusion [23, 121,122]. In meaning of state approximation, there is need of system noise in a stochastic framework for the attack detection method, because it allows a probabilistic state approximation [64, 123]. Hence, there is need to smear mean and variance for state disruption distribution shown as freely variables. Providing of confident state approximation is important in many present applications, e.g., system guidance and navigation, target tracking, and attack [64, 123]. In short, modeling the state distributions in some sets supposed to be unidentified, but limited noises are more suitable. Therefore, ℵ2 is mostly useful based on holding discrepancies in approximation conduct which forecast by a model. Resultant unidentified but limited sounds are suboptimal, and attack detection feasibility is reduced.


## 5.6.1. Argument

Bayesian detection with binary hypothesis has been broadly studied and pragmatic in sensor network data fusion [23, 121,122]. In meaning of state approximation, there is need of system noise in a stochastic framework for the attack detection method, because it allows a probabilistic state approximation [64, 123]. Hence, there is need to smear mean and variance for state disruption distribution shown as freely variables. Providing of confident state approximation is important in many present applications, e.g., system guidance and navigation, target tracking, and attack [64, 123]. In short, modeling the state distributions in some sets supposed to be unidentified, but limited noises are more suitable. Therefore, ℵ2 is mostly useful based on holding discrepancies in approximation conduct which forecast by a model. Resultant unidentified but limited sounds are suboptimal, and attack detection feasibility is reduced.


## 6. Cooperative Attack Methodologies

Comparing to other kinds of attacks, e.g., DoS attack and replay attack, we got no much more interaction of researchers. This is because of phenomenon that fixed on controlling of MASs. Both defending and detection against DoS attacks in a state approximation delinquent were studied in [124, 125]. Data of sensor are transferred to the estimator by a packet, falling communication network. Already defined Kalman filtering [126, 127] for approximation of state for the untrustworthy communication system is pragmatic in this network. First of all, hypothesis testing detection problem is articulated, while supposing already known knowledge of network statics. Secondly, there were considered two preventing policies with the use of secure coding packet slant for recompensing the absence data, and another is improved on transmission power up gradation to control the blocking upshot of attack.In [126, 127], game theory approach has been studied, e.g., collaboration between attacker and sensor is designed as zero sum stochastic game, which finger to DoS attack in remote state approximation. Presence of Nash equilibrium was primarily studied for such kind of game, and later on the best policies were planned for fixing sensor transmission power. For calculation of asymptotic performance of remote approximator, planned form game is applied in [128, 129].For nonlinear chaotic systems, sliding mode control with actuator fault and decentralized sliding mode for heterogeneous MASs problem of fault tolerant control considering both DoS and network fault is discussed in [25, 131]. It is to be supposed that network fault contains of deterioration, signal attenuation, and perturbations of couplings those are in nonlinear form. Reimbursement of perturbed couplings and faulted were gained to apply a strategy which is known as slide mode planned strategy; by way of unidentified constraints of approximation, then the mathematical analysis method and Lyapunov stability theory were applied to assurance the asymptotic management of the nonlinear confused system. We see another example of approximation of delinquent in MASs exposed to DoS attack studied in [7, 130–132].


### 6.1. Secure Control Approaches for DoS Attack

For controlling MASs exposed to DoS attack, many researchers worked; those are shown in Figure10.Figure 10
Secure control approaches of DoS attack.


#### 6.1.1. Stochastic Time-Delay System Approach

Here, DoS is designed as stochastic process with signal delay. Deception and DoS attacks are supposed to be freely stirring and designed as Bernoulli distributed white sequences in [12, 131]. Suppose the discrete time stochastic system with measurements and noise effecting the system, as(23)QP+1=B0+∏i=1zτa,pBaQP+BWP,FP=H0+∏a=1rτi,PHaQP.Here,FP∈Rxf is measurement of sensor and QP+1∈Rxm is state vector, and WP∈Rxw is input of controller. Baa=0,1,…,z,AandHaa=0,1,2,…,l are with appropriate dimension and constant matrices. τa,p∈Ra=1,2,…,z and τa,p∗∈Ra=0,1,2,…,l are multiplicative noises with unity variance and zero means, and jointly uncorrelated with P and a, z and l those are positive integer, A rank is considered to be xw, and to study this kind of problem, we see the given model of attack:(24)FPrφ=μpr≅φ+∂PrφhPrφ+1−μPrφFPr−1φ,where FPrφ = data received by controller and hPrφ∈Rxf = stands for attackers injected signals as in (23):(25)hPrφ=−FPr≅φ+ðprφ,where ðprφ is freely fixed signal which satisfies(26)δPrφ≤epsilon2,ProbμPr=0=1−μ^,ProbμPr=1=μ^,Prob∂Pr=0=1−∂^,Prob∂Pr=1=∂^.μPrand∂Pr = white sequences Bernoulli distributed with 0 and 1 value. Probability is given in (26). In (26),∂.∈0,1and∂∈0,1 are identified constants. Some enough states are gained to confirm the security needs of the system in which we gained some enough conditions.


#### 6.1.2. Impulsive System Approach Hybrid Model

Here, we showed a system that is beneath DoS attack showed by the impulsive system. Resilient control techniques and resources aware are designed with malicious DoS attack studied in [133–135]. Specifically, an event-based control scheme which is output that is output based was pragmatic to control to get the communication strategy and control in lass of nonlinear feedback systems which is provoked by exogenous troubles.Suppose(27)p:Q^K=gKQK,W,U,F=frQK,where p = plant. Here, U∈Rxu = uproar input, F∗∈Rxf = state vector, W∈RxW = control input, andF∈Rxf output of plant:(28)£:Q^q=gqQq,F^,W=fKQq,F^.In this,Yc∈Rxq = controller state, F∗∈Rxf = fresh gained measured output, and W∈Rxw  = controller output; resultant output is r=eQ in which r∈RxrandQ=Qk,Qq. Here, attack is DoS and interval of attack is represented by Mxx∈X∈IDos; at this time period, there is no communication between controller and sensor since attack. DoS attack collection time is given as(29)∅≜∑x∈XMx.To apply framework, hybrid modelF∗ updating can be(30)F∗^=F,Whenρb∄∅,F,^Whenρb∃∅.Transmission errorc≜F∗−f can be(31)c+=F,Whenρb∄∅,F,^Whenρb∃∅.ρmiet=1Lrr1−γ20/0x/l−1+1+0,γ>L,1L1−γ1+γ,γ=L,1Lrarctanhz1−γ2γ/γ+1ℵ/L+1+γ,γ<L.Equation (31) represents maximum allowed transmission interval limited ρmiet that is characterized, where z=γ/L2−1,L≥0 is fixed, γ∈0,1 shows present information in local area at a mechanism known as event triggered mechanism, and we obtained γ as(32)〈∇hQ,gg,c,u≤−σQ−σF−M2Q,W−ϵ1Uc+σ2U2c+ϑ2U2〉.This condition explanation is well studied in [135]. At the end, to suppose DoS attack in normal form, these DoS attacks are banned in form of duration and frequency.


#### 6.1.3. Small Gain Approach

Distribution system stabilization problem exposed to DoS frequency characterization, DoS attack, and preserved stability duration is studied in [135]. To preserve communication resources, a hybrid communication technique is also supposed. By using of hybrid transmission technique, zero behavior can be saved and load communication can be compact efficiently. e.g., a large-scale system contains X interacting subsystem is supposed with given model:(33)ℵa∗φ=BaQaφ+AaQaφ+∐b∈XaMabQbφ.In this,Ba,AaandMab are with suitable breadth. QaφandWaφ,φ∈R>0 are control and state input of the subsystem. Input control applied to “a” subsystem is(34)Waφ=PaQaφPi+∐b∈XiLabQbφpb,where Lab = controller coupling gain.Supposemxx∈X0,m0≥0 representing off/on DoS transmission, e.g., DoS displays time instant transmission from 0 to 1. Hence,(35)Mx≜mx∪mx,mx+ρx.Equation (35) shows xth DoS time instant. ρx is length on which there is DoS attack on the network; suppose(36)∴ρ,φ≜∑x∈X0Mx∑ρ,φ.This is subclass ofρ,φ, and also there is DoS attack on the network.(1) Hypothesis A. Equation (36) is supposed to be constant in DoS frequency, in this τ∈R>0 and ρO∈R>0, as(37)xρ,φ≤τ+φ−ρρO.(2) Hypothesis B. p∈R≥0andZ∈R>1 are present as constant in DoS duration:(38)∴ρ,φ≤p+ρ−φZ.(3) Hypothesis C. When there is no DoS attack, an intersampling interval ∇ is present, e.g.,(39)caφP≤∈aQaφ.∈a is appropriate design constraint.


#### 6.1.4. Deduction A

Equation (33) is representing the distributed system, and equation (34) is for control input, so for this distributed system and control input communication of a plant controller on collective network with Hypothesis C, and sampling ∇ interval. For any DoS attack, the large-scale system is asymptotically constant. Hypothesis A and B with freely τandp and ρOandZ are as follows:(40)1Z+∇∗ρO<τ1τ1+τ2,L1P+L2P≤L.And its subsets are discussed, and second deduction detail is discussed in [136].


#### 6.1.5. Triggering Strategy

Equation (33) is representing the distributed system and equation (34) is for control input, so for this distributed system and control input communication of a plant controller on collective network with Hypothesis C, and sampling ∇ interval. For any DoS attack, the large-scale system is asymptotically constant. Hypothesis A and B with freely τandp and ρOandZ are as follows:(41)1Z+∇∗ρO<τ1τ1+τ2.We supposed a plant jammer-operator, in which communication between plant and operator is effected by jammer studied in [137]. For reduction of the system communication system, an event triggered time order was assumed. Suppose W∈RjandQ∈Rx be input and state vector, respectively. Given system is to be supposed(42)ℵ∗φ=BQφ+AWφ,wφ=PQφP,∀φ∈φp,φP+1,where B, A, and P, are proper dimensions matrices, and φPp≥1 = triggering time sequence. Now, suppose cφ=QφP−Qφ,For all∈⌊φP,φP+1⌋, system is stable, if function WQ=QZKP connected with ⌊E⌋>1 is supposed the control Wφ which at time ZP updated, to see given triggering law(43)cφP2=∈E−1KAP.2QφK2,P≥1.This law time sequence is(44)φp,x=φ1satisfying above equationφ1∈x−1Z,x−1Z+Z01∪xZ.Here, equation (42) is with asymptomatically stable, and equation (44) is triggering law.


#### 6.1.6. Deduction B

See equations (42) and (44) if assumed conditions mollifies. It is studied in [137]:(45)1−∈Z10E−12>Klogμ,μ≔expZ−Z01αB+AP+APαA+AP∗AKB+11−expZ−Z01A∗1−expZ−Z01αB+AP,αB+AP<0.Control strategy for the linear and nonlinear system with the use of the triggered method subjected to DoS attacks depends on study of ISS-Lyapunov function has been described in [138–140]. Maximum %age of time loosing response data deprived of the foremost system is instability was characterized and an event-based controller for that presence of minimum inside sampling time is definite has been supposed.


### 6.2. Game Theory (GT) Approach

GT deals with planned collaboration in between several named players and decision makes [107, 140, 141]. Each player preference order in between many options is increased in an impartial purpose for player, and all players try to optimize own impartial function. It depends on the alternate of another player in any nontrivial game, and this process of optimization depends on the selection of second players [142]. For applications of game theory in the network, we can study the literature [143–145]. For getting secure control in a lot of research studies, this method was pragmatic. Disadvantage which is because of DoS attack is designed as Markov process depends on the game among defending strategies and attack [145]. Using Lyapunov theory, four theorems were derived for assurance of the stability of system. For handling computation complexity of optimal strategies for both players, a Nash Q-learning algorithm is studied [144]. Sensor data are transmitted through a large number of channels remotely, making them vulnerable to malicious attacks. There is need to select one channel to sensor in between these paths with less probability to attack with data transmitting data. It is also decided by attackers that which channel is suitable for attack, e.g., [119]. From literature review, we can find some more examples of applying such kind of approach [142, 146].CoFence Mechanism is assumed for DoS defense attack that endorsed “domain help domain” cooperative network between the NFV-based domain network. Furthermore, there is a dynamic resource allocation characterization for game, and we establish a game model to get incentive-compatible, effective, reciprocal, and fair resource allocation method to work on Nash equilibrium [147]. In [148], the authors supposed conflict between attacker and defender and designed a game theory framework for collective security detection.


### 6.3. Secure Control Approach

For the event triggering system or discrete time system, stochastic time-delay approach can be applied subject to arbitrary DoS attack. The system is designed using Markov process and Bernoulli process with identified statically information to govern the freely present DoS attack. In an event triggered system, impulsive system approach can be applied and is powerful in network control systems as studied in [135]. To reduce the communication in between system part triggering strategy is enough, since signal sent only specific condition of triggering is despoiled, that will minimize burden of communication.Need of throughout information of the system is one limitation in game theory. With imperfect and incomplete information, game theory application is a developing field in network privacy and security. In addition, there is need of agents for correct estimation of security game limitations. For security measures and attack prevention, observation capabilities avail required basis [80, 149].


## 6.1. Secure Control Approaches for DoS Attack

For controlling MASs exposed to DoS attack, many researchers worked; those are shown in Figure10.Figure 10
Secure control approaches of DoS attack.


### 6.1.1. Stochastic Time-Delay System Approach

Here, DoS is designed as stochastic process with signal delay. Deception and DoS attacks are supposed to be freely stirring and designed as Bernoulli distributed white sequences in [12, 131]. Suppose the discrete time stochastic system with measurements and noise effecting the system, as(23)QP+1=B0+∏i=1zτa,pBaQP+BWP,FP=H0+∏a=1rτi,PHaQP.Here,FP∈Rxf is measurement of sensor and QP+1∈Rxm is state vector, and WP∈Rxw is input of controller. Baa=0,1,…,z,AandHaa=0,1,2,…,l are with appropriate dimension and constant matrices. τa,p∈Ra=1,2,…,z and τa,p∗∈Ra=0,1,2,…,l are multiplicative noises with unity variance and zero means, and jointly uncorrelated with P and a, z and l those are positive integer, A rank is considered to be xw, and to study this kind of problem, we see the given model of attack:(24)FPrφ=μpr≅φ+∂PrφhPrφ+1−μPrφFPr−1φ,where FPrφ = data received by controller and hPrφ∈Rxf = stands for attackers injected signals as in (23):(25)hPrφ=−FPr≅φ+ðprφ,where ðprφ is freely fixed signal which satisfies(26)δPrφ≤epsilon2,ProbμPr=0=1−μ^,ProbμPr=1=μ^,Prob∂Pr=0=1−∂^,Prob∂Pr=1=∂^.μPrand∂Pr = white sequences Bernoulli distributed with 0 and 1 value. Probability is given in (26). In (26),∂.∈0,1and∂∈0,1 are identified constants. Some enough states are gained to confirm the security needs of the system in which we gained some enough conditions.


### 6.1.2. Impulsive System Approach Hybrid Model

Here, we showed a system that is beneath DoS attack showed by the impulsive system. Resilient control techniques and resources aware are designed with malicious DoS attack studied in [133–135]. Specifically, an event-based control scheme which is output that is output based was pragmatic to control to get the communication strategy and control in lass of nonlinear feedback systems which is provoked by exogenous troubles.Suppose(27)p:Q^K=gKQK,W,U,F=frQK,where p = plant. Here, U∈Rxu = uproar input, F∗∈Rxf = state vector, W∈RxW = control input, andF∈Rxf output of plant:(28)£:Q^q=gqQq,F^,W=fKQq,F^.In this,Yc∈Rxq = controller state, F∗∈Rxf = fresh gained measured output, and W∈Rxw  = controller output; resultant output is r=eQ in which r∈RxrandQ=Qk,Qq. Here, attack is DoS and interval of attack is represented by Mxx∈X∈IDos; at this time period, there is no communication between controller and sensor since attack. DoS attack collection time is given as(29)∅≜∑x∈XMx.To apply framework, hybrid modelF∗ updating can be(30)F∗^=F,Whenρb∄∅,F,^Whenρb∃∅.Transmission errorc≜F∗−f can be(31)c+=F,Whenρb∄∅,F,^Whenρb∃∅.ρmiet=1Lrr1−γ20/0x/l−1+1+0,γ>L,1L1−γ1+γ,γ=L,1Lrarctanhz1−γ2γ/γ+1ℵ/L+1+γ,γ<L.Equation (31) represents maximum allowed transmission interval limited ρmiet that is characterized, where z=γ/L2−1,L≥0 is fixed, γ∈0,1 shows present information in local area at a mechanism known as event triggered mechanism, and we obtained γ as(32)〈∇hQ,gg,c,u≤−σQ−σF−M2Q,W−ϵ1Uc+σ2U2c+ϑ2U2〉.This condition explanation is well studied in [135]. At the end, to suppose DoS attack in normal form, these DoS attacks are banned in form of duration and frequency.


### 6.1.3. Small Gain Approach

Distribution system stabilization problem exposed to DoS frequency characterization, DoS attack, and preserved stability duration is studied in [135]. To preserve communication resources, a hybrid communication technique is also supposed. By using of hybrid transmission technique, zero behavior can be saved and load communication can be compact efficiently. e.g., a large-scale system contains X interacting subsystem is supposed with given model:(33)ℵa∗φ=BaQaφ+AaQaφ+∐b∈XaMabQbφ.In this,Ba,AaandMab are with suitable breadth. QaφandWaφ,φ∈R>0 are control and state input of the subsystem. Input control applied to “a” subsystem is(34)Waφ=PaQaφPi+∐b∈XiLabQbφpb,where Lab = controller coupling gain.Supposemxx∈X0,m0≥0 representing off/on DoS transmission, e.g., DoS displays time instant transmission from 0 to 1. Hence,(35)Mx≜mx∪mx,mx+ρx.Equation (35) shows xth DoS time instant. ρx is length on which there is DoS attack on the network; suppose(36)∴ρ,φ≜∑x∈X0Mx∑ρ,φ.This is subclass ofρ,φ, and also there is DoS attack on the network.(1) Hypothesis A. Equation (36) is supposed to be constant in DoS frequency, in this τ∈R>0 and ρO∈R>0, as(37)xρ,φ≤τ+φ−ρρO.(2) Hypothesis B. p∈R≥0andZ∈R>1 are present as constant in DoS duration:(38)∴ρ,φ≤p+ρ−φZ.(3) Hypothesis C. When there is no DoS attack, an intersampling interval ∇ is present, e.g.,(39)caφP≤∈aQaφ.∈a is appropriate design constraint.


### 6.1.4. Deduction A

Equation (33) is representing the distributed system, and equation (34) is for control input, so for this distributed system and control input communication of a plant controller on collective network with Hypothesis C, and sampling ∇ interval. For any DoS attack, the large-scale system is asymptotically constant. Hypothesis A and B with freely τandp and ρOandZ are as follows:(40)1Z+∇∗ρO<τ1τ1+τ2,L1P+L2P≤L.And its subsets are discussed, and second deduction detail is discussed in [136].


### 6.1.5. Triggering Strategy

Equation (33) is representing the distributed system and equation (34) is for control input, so for this distributed system and control input communication of a plant controller on collective network with Hypothesis C, and sampling ∇ interval. For any DoS attack, the large-scale system is asymptotically constant. Hypothesis A and B with freely τandp and ρOandZ are as follows:(41)1Z+∇∗ρO<τ1τ1+τ2.We supposed a plant jammer-operator, in which communication between plant and operator is effected by jammer studied in [137]. For reduction of the system communication system, an event triggered time order was assumed. Suppose W∈RjandQ∈Rx be input and state vector, respectively. Given system is to be supposed(42)ℵ∗φ=BQφ+AWφ,wφ=PQφP,∀φ∈φp,φP+1,where B, A, and P, are proper dimensions matrices, and φPp≥1 = triggering time sequence. Now, suppose cφ=QφP−Qφ,For all∈⌊φP,φP+1⌋, system is stable, if function WQ=QZKP connected with ⌊E⌋>1 is supposed the control Wφ which at time ZP updated, to see given triggering law(43)cφP2=∈E−1KAP.2QφK2,P≥1.This law time sequence is(44)φp,x=φ1satisfying above equationφ1∈x−1Z,x−1Z+Z01∪xZ.Here, equation (42) is with asymptomatically stable, and equation (44) is triggering law.


### 6.1.6. Deduction B

See equations (42) and (44) if assumed conditions mollifies. It is studied in [137]:(45)1−∈Z10E−12>Klogμ,μ≔expZ−Z01αB+AP+APαA+AP∗AKB+11−expZ−Z01A∗1−expZ−Z01αB+AP,αB+AP<0.Control strategy for the linear and nonlinear system with the use of the triggered method subjected to DoS attacks depends on study of ISS-Lyapunov function has been described in [138–140]. Maximum %age of time loosing response data deprived of the foremost system is instability was characterized and an event-based controller for that presence of minimum inside sampling time is definite has been supposed.


## 6.1.1. Stochastic Time-Delay System Approach

Here, DoS is designed as stochastic process with signal delay. Deception and DoS attacks are supposed to be freely stirring and designed as Bernoulli distributed white sequences in [12, 131]. Suppose the discrete time stochastic system with measurements and noise effecting the system, as(23)QP+1=B0+∏i=1zτa,pBaQP+BWP,FP=H0+∏a=1rτi,PHaQP.Here,FP∈Rxf is measurement of sensor and QP+1∈Rxm is state vector, and WP∈Rxw is input of controller. Baa=0,1,…,z,AandHaa=0,1,2,…,l are with appropriate dimension and constant matrices. τa,p∈Ra=1,2,…,z and τa,p∗∈Ra=0,1,2,…,l are multiplicative noises with unity variance and zero means, and jointly uncorrelated with P and a, z and l those are positive integer, A rank is considered to be xw, and to study this kind of problem, we see the given model of attack:(24)FPrφ=μpr≅φ+∂PrφhPrφ+1−μPrφFPr−1φ,where FPrφ = data received by controller and hPrφ∈Rxf = stands for attackers injected signals as in (23):(25)hPrφ=−FPr≅φ+ðprφ,where ðprφ is freely fixed signal which satisfies(26)δPrφ≤epsilon2,ProbμPr=0=1−μ^,ProbμPr=1=μ^,Prob∂Pr=0=1−∂^,Prob∂Pr=1=∂^.μPrand∂Pr = white sequences Bernoulli distributed with 0 and 1 value. Probability is given in (26). In (26),∂.∈0,1and∂∈0,1 are identified constants. Some enough states are gained to confirm the security needs of the system in which we gained some enough conditions.


## 6.1.2. Impulsive System Approach Hybrid Model

Here, we showed a system that is beneath DoS attack showed by the impulsive system. Resilient control techniques and resources aware are designed with malicious DoS attack studied in [133–135]. Specifically, an event-based control scheme which is output that is output based was pragmatic to control to get the communication strategy and control in lass of nonlinear feedback systems which is provoked by exogenous troubles.Suppose(27)p:Q^K=gKQK,W,U,F=frQK,where p = plant. Here, U∈Rxu = uproar input, F∗∈Rxf = state vector, W∈RxW = control input, andF∈Rxf output of plant:(28)£:Q^q=gqQq,F^,W=fKQq,F^.In this,Yc∈Rxq = controller state, F∗∈Rxf = fresh gained measured output, and W∈Rxw  = controller output; resultant output is r=eQ in which r∈RxrandQ=Qk,Qq. Here, attack is DoS and interval of attack is represented by Mxx∈X∈IDos; at this time period, there is no communication between controller and sensor since attack. DoS attack collection time is given as(29)∅≜∑x∈XMx.To apply framework, hybrid modelF∗ updating can be(30)F∗^=F,Whenρb∄∅,F,^Whenρb∃∅.Transmission errorc≜F∗−f can be(31)c+=F,Whenρb∄∅,F,^Whenρb∃∅.ρmiet=1Lrr1−γ20/0x/l−1+1+0,γ>L,1L1−γ1+γ,γ=L,1Lrarctanhz1−γ2γ/γ+1ℵ/L+1+γ,γ<L.Equation (31) represents maximum allowed transmission interval limited ρmiet that is characterized, where z=γ/L2−1,L≥0 is fixed, γ∈0,1 shows present information in local area at a mechanism known as event triggered mechanism, and we obtained γ as(32)〈∇hQ,gg,c,u≤−σQ−σF−M2Q,W−ϵ1Uc+σ2U2c+ϑ2U2〉.This condition explanation is well studied in [135]. At the end, to suppose DoS attack in normal form, these DoS attacks are banned in form of duration and frequency.


## 6.1.3. Small Gain Approach

Distribution system stabilization problem exposed to DoS frequency characterization, DoS attack, and preserved stability duration is studied in [135]. To preserve communication resources, a hybrid communication technique is also supposed. By using of hybrid transmission technique, zero behavior can be saved and load communication can be compact efficiently. e.g., a large-scale system contains X interacting subsystem is supposed with given model:(33)ℵa∗φ=BaQaφ+AaQaφ+∐b∈XaMabQbφ.In this,Ba,AaandMab are with suitable breadth. QaφandWaφ,φ∈R>0 are control and state input of the subsystem. Input control applied to “a” subsystem is(34)Waφ=PaQaφPi+∐b∈XiLabQbφpb,where Lab = controller coupling gain.Supposemxx∈X0,m0≥0 representing off/on DoS transmission, e.g., DoS displays time instant transmission from 0 to 1. Hence,(35)Mx≜mx∪mx,mx+ρx.Equation (35) shows xth DoS time instant. ρx is length on which there is DoS attack on the network; suppose(36)∴ρ,φ≜∑x∈X0Mx∑ρ,φ.This is subclass ofρ,φ, and also there is DoS attack on the network.(1) Hypothesis A. Equation (36) is supposed to be constant in DoS frequency, in this τ∈R>0 and ρO∈R>0, as(37)xρ,φ≤τ+φ−ρρO.(2) Hypothesis B. p∈R≥0andZ∈R>1 are present as constant in DoS duration:(38)∴ρ,φ≤p+ρ−φZ.(3) Hypothesis C. When there is no DoS attack, an intersampling interval ∇ is present, e.g.,(39)caφP≤∈aQaφ.∈a is appropriate design constraint.


## 6.1.4. Deduction A

Equation (33) is representing the distributed system, and equation (34) is for control input, so for this distributed system and control input communication of a plant controller on collective network with Hypothesis C, and sampling ∇ interval. For any DoS attack, the large-scale system is asymptotically constant. Hypothesis A and B with freely τandp and ρOandZ are as follows:(40)1Z+∇∗ρO<τ1τ1+τ2,L1P+L2P≤L.And its subsets are discussed, and second deduction detail is discussed in [136].


## 6.1.5. Triggering Strategy

Equation (33) is representing the distributed system and equation (34) is for control input, so for this distributed system and control input communication of a plant controller on collective network with Hypothesis C, and sampling ∇ interval. For any DoS attack, the large-scale system is asymptotically constant. Hypothesis A and B with freely τandp and ρOandZ are as follows:(41)1Z+∇∗ρO<τ1τ1+τ2.We supposed a plant jammer-operator, in which communication between plant and operator is effected by jammer studied in [137]. For reduction of the system communication system, an event triggered time order was assumed. Suppose W∈RjandQ∈Rx be input and state vector, respectively. Given system is to be supposed(42)ℵ∗φ=BQφ+AWφ,wφ=PQφP,∀φ∈φp,φP+1,where B, A, and P, are proper dimensions matrices, and φPp≥1 = triggering time sequence. Now, suppose cφ=QφP−Qφ,For all∈⌊φP,φP+1⌋, system is stable, if function WQ=QZKP connected with ⌊E⌋>1 is supposed the control Wφ which at time ZP updated, to see given triggering law(43)cφP2=∈E−1KAP.2QφK2,P≥1.This law time sequence is(44)φp,x=φ1satisfying above equationφ1∈x−1Z,x−1Z+Z01∪xZ.Here, equation (42) is with asymptomatically stable, and equation (44) is triggering law.


## 6.1.6. Deduction B

See equations (42) and (44) if assumed conditions mollifies. It is studied in [137]:(45)1−∈Z10E−12>Klogμ,μ≔expZ−Z01αB+AP+APαA+AP∗AKB+11−expZ−Z01A∗1−expZ−Z01αB+AP,αB+AP<0.Control strategy for the linear and nonlinear system with the use of the triggered method subjected to DoS attacks depends on study of ISS-Lyapunov function has been described in [138–140]. Maximum %age of time loosing response data deprived of the foremost system is instability was characterized and an event-based controller for that presence of minimum inside sampling time is definite has been supposed.


## 6.2. Game Theory (GT) Approach

GT deals with planned collaboration in between several named players and decision makes [107, 140, 141]. Each player preference order in between many options is increased in an impartial purpose for player, and all players try to optimize own impartial function. It depends on the alternate of another player in any nontrivial game, and this process of optimization depends on the selection of second players [142]. For applications of game theory in the network, we can study the literature [143–145]. For getting secure control in a lot of research studies, this method was pragmatic. Disadvantage which is because of DoS attack is designed as Markov process depends on the game among defending strategies and attack [145]. Using Lyapunov theory, four theorems were derived for assurance of the stability of system. For handling computation complexity of optimal strategies for both players, a Nash Q-learning algorithm is studied [144]. Sensor data are transmitted through a large number of channels remotely, making them vulnerable to malicious attacks. There is need to select one channel to sensor in between these paths with less probability to attack with data transmitting data. It is also decided by attackers that which channel is suitable for attack, e.g., [119]. From literature review, we can find some more examples of applying such kind of approach [142, 146].CoFence Mechanism is assumed for DoS defense attack that endorsed “domain help domain” cooperative network between the NFV-based domain network. Furthermore, there is a dynamic resource allocation characterization for game, and we establish a game model to get incentive-compatible, effective, reciprocal, and fair resource allocation method to work on Nash equilibrium [147]. In [148], the authors supposed conflict between attacker and defender and designed a game theory framework for collective security detection.


## 6.3. Secure Control Approach

For the event triggering system or discrete time system, stochastic time-delay approach can be applied subject to arbitrary DoS attack. The system is designed using Markov process and Bernoulli process with identified statically information to govern the freely present DoS attack. In an event triggered system, impulsive system approach can be applied and is powerful in network control systems as studied in [135]. To reduce the communication in between system part triggering strategy is enough, since signal sent only specific condition of triggering is despoiled, that will minimize burden of communication.Need of throughout information of the system is one limitation in game theory. With imperfect and incomplete information, game theory application is a developing field in network privacy and security. In addition, there is need of agents for correct estimation of security game limitations. For security measures and attack prevention, observation capabilities avail required basis [80, 149].


## 7. Model-Based Attack Methodology

There are two possible forms of occurrence of deception attacks: one is that targeted attacks which defined states are effected and random attacks where arbitrary measurements are defined [48]. In view of control engineering, it is designed as stochastic process [48, 150]. We supposed the following system for best understanding of this idea:(46)QP+1=BQP+AWP,F∗P=HQP,FP=F∗P+μPhP.WP∈Rxw,QP∈RxnandFP∈Rxb,F∗P∈Rxb are the control input, states, received signal, and measured output, respectively, and μP is Bernoulli distributed with deception occurrence possibility with values one and zero; so,(47)ProbμP=1=μ∗,ProbμP=0=1−μ∗.Description of deception attack is(48)hP=−F∗+τP.(1) Note. It is considered that data transferred by attackers mean injected fault data could be subtracted into two steps according to representation of equation (48)−F∗ = for cancellation of original signal, and τP is supposed to be freely limited energy signal as characterized in [150]:(49)∐P=0∞τZPτ≤τ−2.For the time varying class system, variance-constrained distributed problem direct to several divisions of noises, unidentified but limited turbulences, there is also study of deception over sensor network [151]. Present measurement at each node is gathered from both of neighbors and single sensors. There is insertion of deception signals into right signals of input used for controlling WP and output measurements Fa,p during data transmission process shown in Figure 11. An article for designing of deception attack is studied in which nasty signals are inserted by the adversary into both measurement and control data during information communication process via network communication. Following signals effect signals.Figure 11
Deception attack schematic.


## 8. Deception Attack Detection or Identification

It is conscious issue of deception attack estimation for prevention of any detection mechanism since attack form, the main target of affecting stability of the system. Bias injection issue hitting Kalman filter in the system containing chi-square detector is studied [152]. It proved that worst situation problem quadratically constrained can be reduced as quadratic program permits to gain criterion that is useful for selection of sensors for safe and condition on number of sensors need to keep the attack effect with encoded threshold.Centralized security problem for stochastic system linear time-invariant with multidate-sensors fusion subject to deception attack is studied in [6]. Data transferred on each sensor by adversaries as extra signal which makes feasible boundary situations such as [25, 150]. For formulation individual rate discrete time systems, there was use of lifting technique. Using stochastic analysis techniques, enough conditions were gained for gaining already determined original system security level. For effecting uniform quantization, deception attack was supposed in distributive recursive filtering problem of stochastic system discrete time-delayed [6, 83, 153]. We supposed the following system for showing its working:(50)QP+1=B0P+∐r=1ZϵZPBrPQP+B0∅P+∐r=1Z∈rPBr∅PQP+ρ+AP∈P.With sensors “x” studied as(51)F^aP=H0P+ϵ^aPHaPQP+OPhaP,a=1,2,3,…,x.QP state that directly cannot be observed. F^aP is sensor “a” output without quantization. ϵ^aP and haP are white distortions with zero means and conversance unity, collectively uncorrelated “P” and a, ϵ^aP∈R, and ϵZP∈R (Z = 1, 2, 3, …, z) are multiplicative noises with unity variance and zero means, and jointly correlated in P. ρandz are positive integers. BrP,BroPandHaP are identified fixed matrices with well-suited dimensions. In equations (48)–(50), the same dimension effect is studied. Upper limitation for error filtering covariance has been studied in [31].For modeling of distributed state estimator, event triggered scheme is applied to the wireless sensor network for false data injection attack [31, 154]. Each sensor estimate is checked if it attacked at all-time step before transmission of data to nearby sensor, and it may stop in case of attacked. Using event triggered scheme, an optimal estimator gain is supposed to reduce mean square estimation fault covariance, and modeled distributed estimator stability is certain with enough condition of driving. Already the discussed Bayesian method was pragmatic for both estimation and detection of states for MASs subject to turn attack signal and wrong measurements [154, 155].Kalman filter which ensures a safe state estimation algorithm for the stochastic dynamic system was studied in [156–158]. Adversary caused freely subset of sensors is to be supposed in this problem, and an upper limit on sensors effected by attacks was designed to uphold an adequate state approximation fault. Insecure estimation situation is studied for the control system of network direct to fault data insertion attack containing a ℵ2 detector. In addition, a precise algorithm was used, and defense of rare communication channels instead of defending all is studied. Nonlinear stochastic discrete time-delay filtering problem in systems pretentious by arbitrary deception attack and arbitrary sensor saturation were studied in [159]. Suppose the system(52)QP+1=BQP+B∅ℵP−∅P+AgQP+A∅g∅QP−∅P+O∈P.QP∈Rxn = state vector ∈P∈R = zero mean Gaussian, and B,B∅,A,A∅,andO are identified constant matrices with suitable dimensions. The following condition is satisfied by nonlinear functions gandg∅:(53)gQ−P1Q.ZgQ−P2Q≤0,g∅Q−Z1QZg∅Q−Z2Q≤0.In this,P1,P2,Z1,andZ2 are appropriate dimensions real matrices. P1=P1−P2andZ=Z1−Z2 are positive symmetric definite matrices. Given filter designed is supposed in this system:(54)Q^P+1=YQ^P+XfP.To ensure the required security level in the filtering system, an enough condition is derived with stochastic analysis technique. For filter obtaining, inequality linear matrix with constraints of nonlinear is resolved.


### 8.1. Secure Control Approaches of Deception Attack

Deception attack affected discrete time stochastic nonlinear system problem of security control with quadratic cost criterion is studied in [160]. Both actuating and measurement signals were directed to deception as in Figure 11:(55)WP=W^P+∂P∈P.In Figure12, B1 and B2 are supposed to be attacker, in system false data system, e.g., ∈P=−W^P+L1PandhP=−F^P+L2P.,(56)WP=W^P+∂P∈P,(57)FP=F^P+LPhP.where WP = actuator input, W^P = controller outputs directed to attacks, FP = controller gained signal, F^P = sensor measurement directed to attacks, ϵPandhP = transmitted signals by attacker, and ∂PandγP = Bernoulli distributed mutually independent with stochastic variable one and zero, with following probabilities:(58)Prob∂P=1=∂^,Prob∂P=0=1−∂^,ProbLP=1=L^,ProbLP=0=1−L^.Figure 12
Deception attack schematic.In Figure8, B1 and B2 are supposed to be attacker, in system false data system, e.g., ∈P=−W^P+L1PandhP=−F^P+L2P.Structuring a dynamic output field or controller feedback is the basic purpose of this delinquent, e.g., given security in possibility is attained while gaining higher limited of the already choose quadratic cost function. Hence, to derive some enough situations by matrix discriminations form in input-to-state framework stability in possibility stochastic analysis approach was pragmatic. To apply matrix inverse lemma controller obtained upper bound.In [161, 159], there is study of the secure network predictive control system and an architecture for secure and dependent automotive MASs, integrating data message digest algorithm, encryption standard algorithm, predictive control recursive network method, and time-stamp strategy. Predictive control recursive networks rely on time delays, which is pragmatic to ensure the performance of the system, especially when a deception attack influences it.It will accomodate the consequences of attacks and network flaws such as package disorder, package dropout, and time-varying delay.We studied consensus control and consensus management problem in [162]. There was latest definition of quasi-consensus given for describing the consensus performance with constraints on each agent to keep within few ellipsoidal regions at all-time instant, which based on given topology. In addition, measured result is available for controller from both nearby and individual agents. For gaining quasi-consensus, enough situations are gained with the use of recursive matrix for required control system inequalities.A resilient control system [139, 163] has been supposed for network control systems effected by false data injections attacks, so that using measurement data and control input they could not be find. Attack of zero variable on plant state variable is not identified during attack, and it seems after result of attack. Hence, a strong Gaussian controller which is linear quadratic is supposed so that there is online updating of Kalman filter from data transferred by an active version of comprehensive prospect ratio detector with the capability to speedy improve of behavior after attack [164].Actuator attacks and sensor attacks for controller of MASs were proposed in [74, 164–166], and a progressive adaptive strong control scheme is discussed for adversarial mitigating attack in the cyber physical system. Nussbaum function with speedy progressive rate and estimation mechanism is adaptive bound. The double-step back step method was applied to mitigate effects of actuator attack and sensor attacks, and to apply exponentially decaying barrier Lyapunov function, a variable state was controlled.A feasible control delinquent of MASs data-driven direct to actuator attack class is studied in [166], an unidentified nonstop time linear physical system containing outside instabilities was supposed, and input control signal sent via network layers is supposed to be vulnerable to cyberattacks. For eradicating actuator attack effect, nearby optimal performance and stability of MASs can be gained by data-based adaptive essential sliding-mode control approach. Use of abnormal monitor detection mechanism contains detector threshold information, frequency characteristics, and attack structure for a set of frequency constrained actuator, and sensor attack can be studied in [166]. Explained categorization of cyber threats in cyberattack detection of MASs and secure consensus of MASs has been studied in Table 3.Table 3
Categorization of cyber threats in cyberattacks, detection, and consensus of MASs.
Attack typesWork on cyberattack detection of MASsSecure consensus of MASsActuator fault[7, 54,167][90]Sensor fault[168, 169][27]Actuator and sensor fault[30, 169][31, 170]


## 8.1. Secure Control Approaches of Deception Attack

Deception attack affected discrete time stochastic nonlinear system problem of security control with quadratic cost criterion is studied in [160]. Both actuating and measurement signals were directed to deception as in Figure 11:(55)WP=W^P+∂P∈P.In Figure12, B1 and B2 are supposed to be attacker, in system false data system, e.g., ∈P=−W^P+L1PandhP=−F^P+L2P.,(56)WP=W^P+∂P∈P,(57)FP=F^P+LPhP.where WP = actuator input, W^P = controller outputs directed to attacks, FP = controller gained signal, F^P = sensor measurement directed to attacks, ϵPandhP = transmitted signals by attacker, and ∂PandγP = Bernoulli distributed mutually independent with stochastic variable one and zero, with following probabilities:(58)Prob∂P=1=∂^,Prob∂P=0=1−∂^,ProbLP=1=L^,ProbLP=0=1−L^.Figure 12
Deception attack schematic.In Figure8, B1 and B2 are supposed to be attacker, in system false data system, e.g., ∈P=−W^P+L1PandhP=−F^P+L2P.Structuring a dynamic output field or controller feedback is the basic purpose of this delinquent, e.g., given security in possibility is attained while gaining higher limited of the already choose quadratic cost function. Hence, to derive some enough situations by matrix discriminations form in input-to-state framework stability in possibility stochastic analysis approach was pragmatic. To apply matrix inverse lemma controller obtained upper bound.In [161, 159], there is study of the secure network predictive control system and an architecture for secure and dependent automotive MASs, integrating data message digest algorithm, encryption standard algorithm, predictive control recursive network method, and time-stamp strategy. Predictive control recursive networks rely on time delays, which is pragmatic to ensure the performance of the system, especially when a deception attack influences it.It will accomodate the consequences of attacks and network flaws such as package disorder, package dropout, and time-varying delay.We studied consensus control and consensus management problem in [162]. There was latest definition of quasi-consensus given for describing the consensus performance with constraints on each agent to keep within few ellipsoidal regions at all-time instant, which based on given topology. In addition, measured result is available for controller from both nearby and individual agents. For gaining quasi-consensus, enough situations are gained with the use of recursive matrix for required control system inequalities.A resilient control system [139, 163] has been supposed for network control systems effected by false data injections attacks, so that using measurement data and control input they could not be find. Attack of zero variable on plant state variable is not identified during attack, and it seems after result of attack. Hence, a strong Gaussian controller which is linear quadratic is supposed so that there is online updating of Kalman filter from data transferred by an active version of comprehensive prospect ratio detector with the capability to speedy improve of behavior after attack [164].Actuator attacks and sensor attacks for controller of MASs were proposed in [74, 164–166], and a progressive adaptive strong control scheme is discussed for adversarial mitigating attack in the cyber physical system. Nussbaum function with speedy progressive rate and estimation mechanism is adaptive bound. The double-step back step method was applied to mitigate effects of actuator attack and sensor attacks, and to apply exponentially decaying barrier Lyapunov function, a variable state was controlled.A feasible control delinquent of MASs data-driven direct to actuator attack class is studied in [166], an unidentified nonstop time linear physical system containing outside instabilities was supposed, and input control signal sent via network layers is supposed to be vulnerable to cyberattacks. For eradicating actuator attack effect, nearby optimal performance and stability of MASs can be gained by data-based adaptive essential sliding-mode control approach. Use of abnormal monitor detection mechanism contains detector threshold information, frequency characteristics, and attack structure for a set of frequency constrained actuator, and sensor attack can be studied in [166]. Explained categorization of cyber threats in cyberattack detection of MASs and secure consensus of MASs has been studied in Table 3.Table 3
Categorization of cyber threats in cyberattacks, detection, and consensus of MASs.
Attack typesWork on cyberattack detection of MASsSecure consensus of MASsActuator fault[7, 54,167][90]Sensor fault[168, 169][27]Actuator and sensor fault[30, 169][31, 170]


## 9. Key Challenges

Report [82] tells us clearly that there is no high-level security against upcoming attacks or threats. In addition, an open integrated ecosystem idea for cooperation of security issues was studied. Though, in security system, there should be collaboration of stalk holders, it will have advantage form face threat understanding.Key challenge for MASs is that there should be no system outside attack, but also from inside, e.g., a worker who is not interested to learn more about the board system. Designing of protective filter based on results of attack measurement for getting high security is one of the key challenges. To see present filtering technologies, those are not sufficient for security assurance, since it is complicated for defenders to get an idea about the time and trick of cyberattack. The Kalman filter method is not enough for MASs, and it is difficult to gain attacker in statically characterization of signal transmitted [107, 171]. In research studies, interest control problem and filtering in concern of security are getting more and attention, e.g., [79] in which there assurance of security against integrity attacks with the use of minimax optimization advancement [167].With the deficiency of federal reliable power, agent identity verification and creating trust between agents are a big challenge. We can call it decentralization.Basically, agents use knowledge or information which they get or need from decision-making process environment or another nearby agents. It makes an agent susceptible against malicious entries which may share false data to have effect on agent decision.Highly important problem is needed to differentiate an accidental failure from an attack. The resulting sign from these accidental situations has chance of similarity, but reaction should not be the same. Fault is repairable. MASs should have capability to defend itself against attacks. Understanding of operations in MASs may be interrupted by malicious attack. A lot of attack stories have been presented in Table 1 of [78].For MASs, integrity is an important requirement. There is need to pay attention toward sensor networks as well as to data integrity and superstructure. There is also not much more methodology in progressing of secure MAS, so there are several patented results, which may base on possibly exposed approaches.For designing of applications, we need to see both quality of service and security assurance. For practical applications, considering of multiple attacks is an important point that we can face simultaneously. Present planning of security against several forms of attacks is insufficient for industrialization. In addition, security need and resource constraints as energy limitation and communication bandwidth in practically required to be supposed simultaneously.Mobile devices are considered threats carrying because these are using several services and external networks. With the progressing of smart wearable mobile applications, loT of challenges presents in progressive of these applications’ security measures, as there can be risk of human health and life.For smart grids, basic challenges are communication protocol weakness, heterogeneity of protocols, and technology and limitation of physical systems. Table4 represents research work on MAS challenges. Table 5 shows summary of different strategies for MAS while Table 6 represents comparison of different methodologies of system security. General security needs in MASs are integrity (which gives surety that since generation, there is no modification in message), authentication (that is sure that each agent is the one claim to be), confidentiality (which gives surety that only allowed agents are able to read specific data), availability, and authorization. Figure 13 represents overall security challenges in MASs.Table 4
MAS challenges.
Sr. numberChallengesResearch work on MAS challenges1Security[155, 172]2Learning[173, 174]3Fault detection[21, 33, 34, 175]4Localization[176, 177]5Task allocation[178–180]6Organization[176, 177, 181]7Formation[138, 182]8Connectivity[167, 175, 183, 184]9Consensus[167, 175, 183, 184]10Control ability[175, 185, 186]11Synchronization[175, 186]Table 5
Summary of different strategies for MAS.
ApplicationGoalArchitectureDRL algorithmQ function estimatorReferenceMaximum power point tracking (MPPT) controlTo solve MPPT problem of photovoltaic system in practical conditionPhotovoltaic system microgrid baseDeep deterministic policy gradients algorithmDeep neural network (DNN)[153]Secondary control/frequency regulationWith enough load, restoring stabilityHybrid distributed power system as separated small gridActor-critic based algorithmNeural network (NN)[175]Bus voltage stabilityDesigning DC-DC control converterDC microgridQ network/deepQ networkNN[166]Table 6
Comparison of different methodologies of system security.
BenefitsDrawbacksMethodologyResiliency to GPS spoofing attack. Speedy and correct finding of anomaly in gained data. Resiliency to GPS spoofing attackRequire a mathematical model of system because there may be complication without any mathematical model when applying to systemLuenberger observer and artificial neural network (ANN) [172]Resiliency to GPS spoofing and expected attacksSusceptible to unforeseen attack. Costly against abrupt attack has low accuracyMachine learning-based algorithm [39]Low computation load. Resiliency to GPS spoof attackSusceptible against suspicions and system disturbances, model accuracy dependent complicated to apply on nonlinear systemModel-based detection algorithm [148]Secure conventional disturbances in between communication connectionsSusceptible to GPS spoofing attackCommunication [62, 65]Figure 13
Overall MAS security challenges.


## 10. Conclusion and Future Directions

MASs are virtually all around. They can be retrieved and switched remotely, such topographies make susceptible to cyberattacks. There is physical environment process on virtualization and cyber space as a key role for notion plays a central role in MAS. This article explained high-level inclusive discussion regarding various features of MASs that will aid new researchers to cover basic idea of MASs, key challenges in progressing MAS attack, e.g., system failure, virtualization and mobility, and MAS performance methods. First, we studied various attack types in MASs; second, we discussed threats with consistent subtypes and then their possible detection methodologies. After that we give detailed study of MAS attacks and their detection methodologies. Furthermore, an important work of this paper is subjected on several MAS aspects regarding security issues and key challenges. This article will play an important role for researchers to get maximum knowledge about MAS attacks and also to serve as an insightful and overall resources on MASs for researchers.



---

*Source: 6732343-2022-08-02.xml*