# State-Feedback Control for Cyber-Physical Discrete-Time Systems under Replay Attacks: An LMI Approach

Authors: Jose F. V. D. Moreira; Marcio J. Lacerda
Journal: Mathematical Problems in Engineering
 (2022)

---

## Abstract

This paper addresses the state-feedback control problem for cyber-physical discrete-time linear systems. The main goal is to design state-feedback controllers that can mitigate the interference of replay attacks in the stability of the closed-loop system. The system under replay attack is modeled as a switched linear system, and a packet-based approach is employed for control design. New conditions in the form of Linear Matrix Inequalities are presented to provide stabilizing controllers. Numerical experiments illustrate the effectiveness of the proposed method.


---

## Body

## 1. Introduction

The fourth Industrial Revolution (Industry 4.0) provided the use of complex technologies nowadays since there was a need for people to develop, grow and make life easier in general. Cyber-Physical Systems (CPSs) are among the technologies currently used. They are composed of computational resources, communication networks, and physical processes in integrated action [1, 2].The use of CPS has several advantages, such as simplicity of maintenance and installation, high efficiency, and fair cost. In addition, the applications include industrial control systems, electrical power networks, and transport systems in general (vehicle and aviation, for example), among many others [3, 4]. However, there are some issues to consider in a CPS. Communication delays and packet losses during network transmission are examples of these disadvantages since they affect system performance and stability. Some studies in the literature on packet losses show that losses are classified as arbitrary and Markovian. In addition, packet loss modeling is possible in both communication directions (sensor to controller and controller to the actuator) [1, 3].Cybersecurity is relevant due to another negative aspect of using communication networks, the existence of cyber-physical attacks [1]. As examples of occurrences, one can cite the Stuxnet virus and the attack on the sewer system in Queensland/Australia in the year 2000. Stuxnet, found in Siemens programmable logic controllers in 2010, was responsible for disturbing the Iranian nuclear installation in Natanz. The complexity of the attack showed that the attacker had prior knowledge of the cyber-physical components of the control system [5]. The damage caused by the attacks is significant, as happened in Australia in 2000, where sewage spills reached parks, hotels, and rivers [6]. Due to the damage that these attacks may cause, it is necessary to analyze and propose new solutions for systems under the presence of malicious attacks.Among the cyber-attacks, one may cite the denial of service (DoS) attacks and deception attacks. DoS attacks consist of blocking communication between cybernetic physical elements. On the other hand, deception attacks correspond to one or more components receiving false information that they believe to be true. In this work, we investigate a subtype of deception attack, called a replay attack [3, 5]. This type of attack is difficult to detect compared to DoS attacks since replay’s attack operation consists of the attacker recording the sensor measurements first and the invader replacing the correct data at the current instant k with the data recorded previously at the instant k−1. Therefore, exchanging the actual values for previous measurements can result in incorrect decision-making, capable of destabilizing the system. Movies present a classic example of replay attacks, where criminals or people with bad intentions exchange images from security cameras with previously recorded video, with the aim of crimes or sabotage.A CPS is composed of several security layers, with attack detection and control design being some of them. Many recent works have focused on finding new ways to detect replay attacks [7–10]. However, the research on control design for systems under replay attacks still is scarce. Thus, the goal of this article is to present a new formulation to design state-feedback controllers that can stabilize the system under replay attacks, once the attacks have been detected. If the states of the system are not available, output-feedback control strategies should be employed. Among others, output-feedback control strategies are dealing with switching systems, and CPS under DoS attacks [11–13].The attack was modeled as aT+1 mode switched system, where T is the maximum delay of the replay attack. The first mode represents the absence of the attack, while the second mode represents a 1 delay instant; subsequent modes will be defined similarly. The last mode will be set with a delay of T instants of time. For each system mode, a controller is available to act and stabilize the closed-loop system. Moreover, a single controller can be designed to guarantee the stability of all modes of the switched system. By using the Lyapunov theory, a new Linear Matrix Inequality (LMI) condition was developed to guarantee the stability of the closed-loop system. The Lyapunov theory allows to write the conditions in the form of LMIs and solving them by available computational packages [14, 15]. A switched Lyapunov function allows the use of slack variables which are introduced in the problem to lessen the conservativeness [16]. The control gain is recovered from the slack matrices instead of using the Lyapunov matrix. The proposed approach can stabilize the closed-loop system even when the replay attack is performed in a random sequence.Motivated by the above discussion, the main contributions of this paper are summarized as follows:(i)
The use of a switched model to describe the system under replay attack. Each mode of the system is related to a different delay used by the attacker.(ii)
New sufficient conditions, in the form of parameter-dependent Linear Matrix Inequalities (LMIs), to design state-feedback controllers for CPS under replay attacks.(iii)
The use of a switched Lyapunov function that provides less conservative results when compared with a common quadratic Lyapunov function.The rest of this paper is laid out as follows: Preliminary Concepts are introduced in Section2 and give the necessary background material to understand the main idea of the work. Then, the proposed method is presented in Section 3. Section 4 presents numerical experiments that illustrate the efficiency of the proposed method to mitigate the existence of constant and randomly replay attacks in the CPS under replay attack. Finally, the Conclusions are given in Section 5.Notation: in this paper,ℝ denotes the field of real numbers. When a matrix P is positive definite (including symmetry), we write P>0. Similarly, we write P<0 for negative definiteness. By 0 and I, we denote the null and identity matrices of appropriate dimensions. For vectors and matrices, the superscript ⊤ means transpose. 1T denotes the vector 11⋯1︸T−times. We write ⊗ for Kronecker product.


## 2. Preliminary Concepts

Consider a CPS plant, described by the following discrete-time system model:(1)xk+1=Axk+Buk,where x∈ℝn is the state vector, and u∈ℝnu is the control input. The matrices A∈ℝn×n and B∈ℝn×nu are precisely known matrices.The performance of the CPS under replay attack is affected since the attacker changes the measurements through the network for illegal purposes. Therefore, it is relevant to develop skillful control techniques to minimize the attacker’s influence on the system. In this way, the closed-loop system will remain stable.Figure1 illustrates the schematic of the CPS under replay attack. The attacker’s presence on the network allows him to prerecord xk values at earlier instants to posteriorly change them to xk−τ, where τ is the delay of the replay attack. In this sense, the communication channel between the sensor and the buffer transmits the information of the state, called x¯k. Note that, in the absence of attack x¯k=xk, otherwise x¯k=xk−τ.Figure 1
Schematic of the structure of a CPS under replay attacks.Assumption 1.
The maximum delay of replay attack is limited byT, as the attacker has a preattack information storage limitation according to the desired lagging. Thus, the attacker requires a more robust system for storing information as the delay increases.
It is worth mentioning that the replay attack can be applied randomly, respecting the delay limitT. Figure 2 depicts an example of a possible replay attack sequence, where delay represents the replay attack. In this case, T=6 is the maximum delay of the replay attack.
The modeling of the problem considering a packet-based approach follows the same lines presented in [17, 18] for CPS under DoS attacks. The state-feedback control law that stabilizes the CPS in (1) is given by the following equation:(2)uk=Kτxk−τ,where k is the time instant of the actual replay attack and τ is the switching point that takes a value in a finite set M≜0,1,…,T. Note that, if τ=0, there are no replay attacks at the time k.
The closed-loop system dynamics, obtained by applying the control law (2) in the CPS (1), between switching points can be described by the following case:(i)
Case 0: replay-free case(3)xk+1=Axk+F0xk,F0≜BK0.(ii)
Case 1: replay attack with delay of 1 instant of time(4)xk+1=Axk+F1xk−1,F1≜BK1.(iii)
CaseT: replay attack with delay of T instant of time.(5)xk+1=Axk+FTxk−T,FT≜BKT.
Notice that, by employing theT+1 modes (3)–(5), the following switched system describes the system dynamics between two switching points:(6)zk+1=Φizk,where zk⊤=xk⊤xk−1⊤…xk−T⊤, Φi=EiInT0nT×n, and(7)Ei=A0n×nT+0n×niFi0n×T−in.
Note that, there is a package of controllers fori=0,1,…,T, that acts according to the attack delay. It is clear since there is a Ki for each mode Φi. Only one mode of the switched system (6) is active at a time. The indicator function will be used to describe such behavior. Consider ξk=ξ0k,…,ξTk⊤.(8)ξik=1,ifsk=i.0,otherwise.
In this way, system (6) can be written as follows:(9)zk+1=Φξkzk,with Φξk=ξ0kΦ0+ξ1kΦ1+⋯+ξTkΦT.Figure 2
Example of a possible replay attack sequence.Assumption 2.
The system is able to detect which delay the attacker applied on instantk. After it, the CPS uses the appropriate controller designed by the proposed method.
Here is an example to illustrate the switched system. Figure2 indicates a random replay attack. The sequence of the attack is 4,0,0,0,2,1,6,5,3,…, where T=6 is the maximum delay of the replay attack. Therefore, the controller sends a package every instant in the following format:(10)Uk=uk⊤uk−1⊤uk−2⊤uk−3⊤uk−4⊤uk−5⊤uk−6⊤⊤.
This way, the control selection happens according to the delay of the attack in the instantk. In this example, it is uk−4 at instant 1, uk at instant 2, …, uk−2 at instant 5, and so on.
Based on the use of a switched Lyapunov function, the following Lemma obtains a stability certificate for system (7).Lemma 1.
If there exist symmetric positive definite matricesPi∈ℝn×n such that(11)PiΦi⊤PjPjΦiPj>0,with i,j∈M≜0,1,…,T, then the switched Lyapunov system (7) under arbitrary switching with Φi given as in (6) is asymptotically stable.Proof.
Multiplying (8) by ξik, i=0,…,T, and summing up gives(12)PξkΦξk⊤PjPjΦξkPj>0.
Similarly, multiplying (9) by ξjk+1, j=0,…,T, and summing up, results in(13)Pξk,Φξk⊤Pξk+1Pξk+1Φξk,Pξk+1>0.
The application of a Schur complement in (13) yields Pξk−Φξk⊤Pξk+1Φξk>0, that can be written as follows:(14)Φξk⊤Pξk+1Φξk−Pξk<0,
Pre-and postmultiplying it byzk⊤ and zk, respectively, is equivalent to write ΔVzk<0 with Vzk=zk⊤Pξkzk. From (11), it can be seen that Pξk>0, then the Lyapunov function Vzk is positive definite concluding the proof.


## 3. Main Results

For the sake of clarity, before presenting the formulation for a generic time delay of replay attacks, a particular case is addressed, where the time delay of replay attacks is bounded byT=1, i.e., M≜0,1. The following result uses a switched Lyapunov function to design state-feedback gains.Lemma 2.
If there exist symmetric positive definite matricesPi∈ℝ2n×2n, matrices Xij∈ℝn×2n,i≠j, Yi∈ℝn×n, Zi∈ℝnu×n, and i,j∈M≜0,1 such that(15)−P0X0⊤Ψ⊤+Υ0⊤ΨX0+Υ0P0−X0−X0⊤<0,−P0X0⊤Ψ⊤+Υ0⊤ΨX0+Υ0P1−X1−X1⊤<0,−P1X1⊤Ψ⊤+Υ1⊤ΨX1+Υ1P0−X0−X0⊤<0,−P1X1⊤Ψ⊤+Υ1⊤ΨX1+Υ1P1−X1−X1⊤<0,hold with(16)Υ0=BZ0BZ00n×2n,Υ1=BZ1BZ10n×2n,Ψ=A0n×nIn0n×n,X0=X00X01,X1=X10X11,where the matrices Xii are given by the following equation:(17)X00=Y0Y0,X11=Y1Y1,then(18)K0=Z0Y0−1,K1=Z1Y1−1,are the state-feedback control gains that assure the closed-loop system (7) is asymptotically stable.Proof.
First, perform the change of variablesZ1=K1Y1 and Z0=K0Y0, i,j∈M in Lemma 2, resulting in(19)−P0X0⊤Φ0⊤Φ0X0P0−X0−X0⊤<0,−P0X0⊤Φ0⊤Φ0X0P1−X1−X1⊤<0,−P1X1⊤Φ1⊤Φ1X1P0−X0−X0⊤<0,−P1X1⊤Φ1⊤Φ1X1P1−X1−X1⊤<0.with(20)Φ0=A+BK00I0,Φ1=ABK1I0.
Note that, the set of constraints (19) and (20) can be written as follows:(21)−PiXi⊤Φi⊤ΦiXiPj−Xj−Xj⊤<0,for i=0,1, and j=0,1. Multiplying (21) by ξ0k2, ξ1k2 and summing up one has the following equation:(22)−PξkXξk⊤Φξk⊤ΦξkXξkPj−Xj−Xj⊤<0,j=0,1.
Following the same procedure, and multiplying (22) by ξ0k+1, ξ1k+1 and summing up yields(23)−PξkXξk⊤Φξk⊤ΦξkXξkPξk+1−Xξk+1−Xξk+1⊤<0.
Multiplying (23) by ζ on the left, and by ζ⊤ on the right, with ζ=Xξk+1−⊤00Xξk+1−⊤ gives(24)−Xξk−⊤PξkXξk−1Φξk⊤Xξk+1−1Xξk+1−⊤ΦξkR<0,with R=Xξk+1−⊤Pξk+1Xξk+1−1−Xξk+1−⊤−Xξk+1−1.
Multiplying (24) by W on the left and by W⊤ on the right, with W=IΦξk⊤ gives the following equation:(25)Φξk⊤Xξk+1−⊤Pξk+1Xξk+1−1Φξk−Xξk−⊤PξkXξk−1<0.
Pre- and post-multiplying it byzk⊤ and zk, respectively, is equivalent to write ΔVzk<0 with Vzk=zk⊤Xξk−⊤PξkXξk−1zk. Moreover, from (21) it can be seen that Pξk>0, then the Lyapunov function Vzk is positive definite concluding the proof.Remark 1.
It is important to highlight that the conditions presented make use of a switched Lyapunov function which provides less conservative results when compared with the common quadratic Lyapunov functions [19].
A generic approach consideringM≜0,1,…,T replay attack delays is presented in the sequel.Theorem 1.
If there exist symmetric positive definite matricesPi∈ℝT+1n×T+1n, matrices Xij∈ℝn×T+1n, i≠j, Yi∈ℝn×n, and Zi∈ℝnu×n, such that(26)−PiXi⊤Ψ⊤+Υi⊤ΨXi+ΥiPj−Xj−Xj⊤<0,hold with(27)Ψ=A0n×nTInT0nT×n,Υi=1T+1⊗Gi,Gi=BZi0nT×n,Xi=Xi0⋮Xij,where 1T+1 denotes the vector 11⋯1︸T+1−times, Xii=1T+1⊗Yi, and i,j∈M≜0,1,…,T, then(28)Ki=ZiYi−1,are the state-feedback control gains that assure the asymptotical stability of the closed-loop system (7).Proof.
First, perform the change of variablesZi=KiYi, i∈M in (26), resulting in(29)−PiXi⊤Φi⊤ΦiXiPj−Xj−Xj⊤<0.
Thus, the proof may be completed following the steps performed in Lemma2.
Consider the case when the duration of the replay attack is constant; that is,s=T in (5). Then the switched system in (6) can be simplified to a precisely known system given by the following equation:(30)zk+1=Φzk,where Φ=EInT0nT×n and E=A0n×nT+0n×nTBK. Then, Theorem 1 can be simplified to design a robust state-feedback controller which can stabilize system (30). The following corollary presents the condition for such a case.Corollary 1.
If there exist symmetric positive definite matricesP∈ℝT+1n×T+1n, matrices X1∈ℝTn×T+1n, Y∈ℝn×n, and Z∈ℝnu×n, such that(31)−PX⊤Ψ⊤+Υ⊤ΨX+ΥP−X−X⊤<0,hold with(32)Ψ=A0n×nTInT0nT×n,Υ=1T+1⊗G,G=BZ0nT×n,X=X1X2,where X2=1T+1⊗Y, then(33)K=ZY−1,is the state-feedback control gain that assures the asymptotical stability of the closed-loop system (30) under a constant replay attack of delay T.Remark 2.
The condition presented in Corollary1 presents more conservative results than Theorem 1 since it considers that the replay attack has a constant delay. However, there is only one switching state in this case which leads to a much lower computational cost.Remark 3.
Consider the condition presented in Theorem1 and i,j∈M≜0,1,…,T. The number of LMI rows is 2nT+13 , while this number reduces to 2nT+1 if Corollary 1 is considered.Remark 4.
Similarly, the number of scalar decision variables required by Theorem1Nv can be formulated as follows:(34)Nv=T+12T+13n2T+n2+n+2nun+2n2.
It is possible to see that the computational complexity of this approach will grow along with the increase of the maximum delay of the replay attackT. Finally, note that if Corollary 1 is employed then, Nv=T+1/23n2T+n2+n+nun+n2.


## 4. Numerical Experiments

In this section, two examples illustrate the usefulness of the proposed methods. The package YALMIP [14] was applied to implement the routines in Matlab, and SEDUMI [15] was the solver employed. It is important to stress that the results were obtained by using a switched Lyapunov function. Moreover, for the proposed examples, the use of a common quadratic Lyapunov function could not find feasible results for T>0.


### 4.1. Example 1

#### 4.1.1. Reference Results

Consider the discrete-time system borrowed from [20] with matrices given by the following equation:(35)A=0.99630.00140.04620.00300.00100.99900.00050.0495−0.14210.05530.85300.11580.0397−0.04060.02000.9796,B=0.00150.0000417880.0000106430.00100.05780.00250.000634480.0412.At first, the state-feedback gain of the system described in (35) with T=0 was obtained using Theorem 3 described in [21]. The gain matrix obtained is given by the following equation:(36)K=−8.0628−0.3603−15.0008−0.9650−0.8248−13.7972−0.2553−24.1423.This result will be used as a comparative reference in the following cases.


#### 4.1.2. Case 1: Replay Attack by Theorem1 with T=0

There is no presence of attack in this case. The gain obtained by Theorem1 with T=0 yields(37)K=−8.0614−0.3604−15.0008−0.9650−0.8249−13.7954−0.2553−24.1423.In the absence of attacks, the controllers given in (36) and (37) stabilize the system. However, there is no guarantee that they can stabilize the system in the presence of attacks.


#### 4.1.3. Case 2: Replay Attack by Theorem1 with T=7

Theorem 1 was employed on the system described in (20), considering T=7 as the bound to the replay attack. Therefore, the controller obtained will switch according to the delay used by the malicious agent. Table 1 shows the state-feedback controllers obtained.Table 1
Switched state-feedback gains for example 1.
TK02.0881−0.94471.5647−1.8336−0.93980.6061−0.4620−0.353112.0186−0.89831.5959−1.7942−0.92300.6097−0.4866−0.300221.9413−0.84951.6133−1.7511−0.90330.6102−0.5066−0.259831.8646−0.80341.6165−1.7078−0.88040.6074−0.5176−0.233041.8017−0.76751.6035−1.6712−0.85990.6035−0.5184−0.222651.7785−0.74841.5993−1.6625−0.85350.6075−0.5145−0.225861.7977−0.74351.6243−1.6888−0.86550.6207−0.5158−0.238771.8466−0.74321.6737−1.7470−0.89020.6478−0.5265−0.2602The results in Table1 are employed in the temporal response depicted in Figure 3. The controller can stabilize the system even under the presence of random delays, emphasizing that the proposed method can stabilize the system under replay attacks. The initial conditions for each state, which must have at least T+1 state values, are(38)x1=28.1559.0645.1328.1513.8650.3844.9418.92,x2=23.0466.0424.0973.1158.8248.9696.3566.71,x3=71.1104.7671.5013.7836.6287.7004.2358.64,x4=62.4634.8885.6283.6780.6835.3197.3067.50.Figure 3
Temporal response with the maximum replay attack bounded byT=7 using controllers given in Table 1.Figure4 presents the sequence of time delays applied in the proposed replay attack according to the k values. This sequence is periodic for every sampled time interval. That is, it is used from 0 to 40, 40 to 80, 80 to 120, and so forth.Figure 4
Variation of delay in the replay attack according tok for example 1-case 2.This example shows a situation that has a higher computational cost. However, the attacker will likely try to affect the system in the most complex way possible. Therefore, it is relevant to have a robust prevention system against this type of attack.


#### 4.1.4. Case 3: Constant Replay Attack by Corollary1 with T=9

There is a constant delay of 9 instants ofk in this case. The gain obtained by Corollary 1 with T=9 is given by the following equation:(39)K=2.0422−0.81312.0400−1.9278−0.90140.7707−0.42570.0657.Figure5 exhibits the temporal response using the gain obtained with Corollary 1. The initial conditions are(40)x˜1=97.2795.42x1,x˜2=32.7803.19x2,x˜3=83.7835.69x3,x˜4=73.9166.27x4.Figure 5
Temporal response for a constant replay attack withT=9 using the controller (39).The temporal response in Figure5 displays the effectiveness of the proposed method, which manages to stabilize the system under the presence of a constant replay attack.


### 4.2. Example 2

To illustrate the potential of application of the proposed method, consider an angular positioning system borrowed from [22]. In this example, we use δk=0.1, which is proportional to the coefficient of viscous friction in the rotation parts of the antenna. Therefore, the system matrices are given by the following equation:(41)A=10.100.99,B=00.01.Similarly to example 1, Theorem1 was employed to solve this problem. We have considered T=6 as the maximum delay of the replay attack. In this way, the controller obtained will vary according to the attack delay. Table 2 presents the state-feedback controllers obtained. Note that, there are T+1 modes, i.e., seven modes in this case.Table 2
Switched state-feedback gains for example 2.
TK0−1.7378−5.55111−1.6166−5.31042−1.5107−5.14443−1.4252−5.05004−1.3743−5.04435−1.3512−5.16046−1.2986−5.3999Figure6 presents the temporal response which illustrates that the controller can stabilize the system using the control gains in Table 2. The initial conditions employed are(42)x1=55.170.625.347.480.053.235.2,x2=10.127.035.260.553.245.340.1.Figure 6
Temporal Response with the maximum replay attack bounded byT=6 using controllers given in Table 2.Figure7 presents the sequence of time delays applied in the proposed replay attack. This sequence of attacks is possible according to the proposed random modeling from (3) to (7).Figure 7
Variation of delay in the replay attack according tok for example 2.


## 4.1. Example 1

### 4.1.1. Reference Results

Consider the discrete-time system borrowed from [20] with matrices given by the following equation:(35)A=0.99630.00140.04620.00300.00100.99900.00050.0495−0.14210.05530.85300.11580.0397−0.04060.02000.9796,B=0.00150.0000417880.0000106430.00100.05780.00250.000634480.0412.At first, the state-feedback gain of the system described in (35) with T=0 was obtained using Theorem 3 described in [21]. The gain matrix obtained is given by the following equation:(36)K=−8.0628−0.3603−15.0008−0.9650−0.8248−13.7972−0.2553−24.1423.This result will be used as a comparative reference in the following cases.


### 4.1.2. Case 1: Replay Attack by Theorem1 with T=0

There is no presence of attack in this case. The gain obtained by Theorem1 with T=0 yields(37)K=−8.0614−0.3604−15.0008−0.9650−0.8249−13.7954−0.2553−24.1423.In the absence of attacks, the controllers given in (36) and (37) stabilize the system. However, there is no guarantee that they can stabilize the system in the presence of attacks.


### 4.1.3. Case 2: Replay Attack by Theorem1 with T=7

Theorem 1 was employed on the system described in (20), considering T=7 as the bound to the replay attack. Therefore, the controller obtained will switch according to the delay used by the malicious agent. Table 1 shows the state-feedback controllers obtained.Table 1
Switched state-feedback gains for example 1.
TK02.0881−0.94471.5647−1.8336−0.93980.6061−0.4620−0.353112.0186−0.89831.5959−1.7942−0.92300.6097−0.4866−0.300221.9413−0.84951.6133−1.7511−0.90330.6102−0.5066−0.259831.8646−0.80341.6165−1.7078−0.88040.6074−0.5176−0.233041.8017−0.76751.6035−1.6712−0.85990.6035−0.5184−0.222651.7785−0.74841.5993−1.6625−0.85350.6075−0.5145−0.225861.7977−0.74351.6243−1.6888−0.86550.6207−0.5158−0.238771.8466−0.74321.6737−1.7470−0.89020.6478−0.5265−0.2602The results in Table1 are employed in the temporal response depicted in Figure 3. The controller can stabilize the system even under the presence of random delays, emphasizing that the proposed method can stabilize the system under replay attacks. The initial conditions for each state, which must have at least T+1 state values, are(38)x1=28.1559.0645.1328.1513.8650.3844.9418.92,x2=23.0466.0424.0973.1158.8248.9696.3566.71,x3=71.1104.7671.5013.7836.6287.7004.2358.64,x4=62.4634.8885.6283.6780.6835.3197.3067.50.Figure 3
Temporal response with the maximum replay attack bounded byT=7 using controllers given in Table 1.Figure4 presents the sequence of time delays applied in the proposed replay attack according to the k values. This sequence is periodic for every sampled time interval. That is, it is used from 0 to 40, 40 to 80, 80 to 120, and so forth.Figure 4
Variation of delay in the replay attack according tok for example 1-case 2.This example shows a situation that has a higher computational cost. However, the attacker will likely try to affect the system in the most complex way possible. Therefore, it is relevant to have a robust prevention system against this type of attack.


### 4.1.4. Case 3: Constant Replay Attack by Corollary1 with T=9

There is a constant delay of 9 instants ofk in this case. The gain obtained by Corollary 1 with T=9 is given by the following equation:(39)K=2.0422−0.81312.0400−1.9278−0.90140.7707−0.42570.0657.Figure5 exhibits the temporal response using the gain obtained with Corollary 1. The initial conditions are(40)x˜1=97.2795.42x1,x˜2=32.7803.19x2,x˜3=83.7835.69x3,x˜4=73.9166.27x4.Figure 5
Temporal response for a constant replay attack withT=9 using the controller (39).The temporal response in Figure5 displays the effectiveness of the proposed method, which manages to stabilize the system under the presence of a constant replay attack.


## 4.1.1. Reference Results

Consider the discrete-time system borrowed from [20] with matrices given by the following equation:(35)A=0.99630.00140.04620.00300.00100.99900.00050.0495−0.14210.05530.85300.11580.0397−0.04060.02000.9796,B=0.00150.0000417880.0000106430.00100.05780.00250.000634480.0412.At first, the state-feedback gain of the system described in (35) with T=0 was obtained using Theorem 3 described in [21]. The gain matrix obtained is given by the following equation:(36)K=−8.0628−0.3603−15.0008−0.9650−0.8248−13.7972−0.2553−24.1423.This result will be used as a comparative reference in the following cases.


## 4.1.2. Case 1: Replay Attack by Theorem1 with T=0

There is no presence of attack in this case. The gain obtained by Theorem1 with T=0 yields(37)K=−8.0614−0.3604−15.0008−0.9650−0.8249−13.7954−0.2553−24.1423.In the absence of attacks, the controllers given in (36) and (37) stabilize the system. However, there is no guarantee that they can stabilize the system in the presence of attacks.


## 4.1.3. Case 2: Replay Attack by Theorem1 with T=7

Theorem 1 was employed on the system described in (20), considering T=7 as the bound to the replay attack. Therefore, the controller obtained will switch according to the delay used by the malicious agent. Table 1 shows the state-feedback controllers obtained.Table 1
Switched state-feedback gains for example 1.
TK02.0881−0.94471.5647−1.8336−0.93980.6061−0.4620−0.353112.0186−0.89831.5959−1.7942−0.92300.6097−0.4866−0.300221.9413−0.84951.6133−1.7511−0.90330.6102−0.5066−0.259831.8646−0.80341.6165−1.7078−0.88040.6074−0.5176−0.233041.8017−0.76751.6035−1.6712−0.85990.6035−0.5184−0.222651.7785−0.74841.5993−1.6625−0.85350.6075−0.5145−0.225861.7977−0.74351.6243−1.6888−0.86550.6207−0.5158−0.238771.8466−0.74321.6737−1.7470−0.89020.6478−0.5265−0.2602The results in Table1 are employed in the temporal response depicted in Figure 3. The controller can stabilize the system even under the presence of random delays, emphasizing that the proposed method can stabilize the system under replay attacks. The initial conditions for each state, which must have at least T+1 state values, are(38)x1=28.1559.0645.1328.1513.8650.3844.9418.92,x2=23.0466.0424.0973.1158.8248.9696.3566.71,x3=71.1104.7671.5013.7836.6287.7004.2358.64,x4=62.4634.8885.6283.6780.6835.3197.3067.50.Figure 3
Temporal response with the maximum replay attack bounded byT=7 using controllers given in Table 1.Figure4 presents the sequence of time delays applied in the proposed replay attack according to the k values. This sequence is periodic for every sampled time interval. That is, it is used from 0 to 40, 40 to 80, 80 to 120, and so forth.Figure 4
Variation of delay in the replay attack according tok for example 1-case 2.This example shows a situation that has a higher computational cost. However, the attacker will likely try to affect the system in the most complex way possible. Therefore, it is relevant to have a robust prevention system against this type of attack.


## 4.1.4. Case 3: Constant Replay Attack by Corollary1 with T=9

There is a constant delay of 9 instants ofk in this case. The gain obtained by Corollary 1 with T=9 is given by the following equation:(39)K=2.0422−0.81312.0400−1.9278−0.90140.7707−0.42570.0657.Figure5 exhibits the temporal response using the gain obtained with Corollary 1. The initial conditions are(40)x˜1=97.2795.42x1,x˜2=32.7803.19x2,x˜3=83.7835.69x3,x˜4=73.9166.27x4.Figure 5
Temporal response for a constant replay attack withT=9 using the controller (39).The temporal response in Figure5 displays the effectiveness of the proposed method, which manages to stabilize the system under the presence of a constant replay attack.


## 4.2. Example 2

To illustrate the potential of application of the proposed method, consider an angular positioning system borrowed from [22]. In this example, we use δk=0.1, which is proportional to the coefficient of viscous friction in the rotation parts of the antenna. Therefore, the system matrices are given by the following equation:(41)A=10.100.99,B=00.01.Similarly to example 1, Theorem1 was employed to solve this problem. We have considered T=6 as the maximum delay of the replay attack. In this way, the controller obtained will vary according to the attack delay. Table 2 presents the state-feedback controllers obtained. Note that, there are T+1 modes, i.e., seven modes in this case.Table 2
Switched state-feedback gains for example 2.
TK0−1.7378−5.55111−1.6166−5.31042−1.5107−5.14443−1.4252−5.05004−1.3743−5.04435−1.3512−5.16046−1.2986−5.3999Figure6 presents the temporal response which illustrates that the controller can stabilize the system using the control gains in Table 2. The initial conditions employed are(42)x1=55.170.625.347.480.053.235.2,x2=10.127.035.260.553.245.340.1.Figure 6
Temporal Response with the maximum replay attack bounded byT=6 using controllers given in Table 2.Figure7 presents the sequence of time delays applied in the proposed replay attack. This sequence of attacks is possible according to the proposed random modeling from (3) to (7).Figure 7
Variation of delay in the replay attack according tok for example 2.


## 5. Conclusion

This paper introduced new conditions for the design of state-feedback controllers for cyber-physical discrete-time linear systems under replay attacks, through the use of the Lyapunov theory and LMIs. The system was modeled as a switched linear system to cope with the problem. Two examples have been presented to show the effectiveness of the method. Three situations were considered; (i) there is no replay attack, (ii) randomly replay attack, and (iii) constant replay attack. It has been shown that the proposed method can provide controllers to mitigate the effects of replay attacks. In future research, the authors are investigating the presence of time-varying parameters and DoS attacks in cyber-physical systems under replay attacks. Moreover, the design of output-feedback controllers is a promising direction for future work.



---

*Source: 7946710-2022-09-01.xml*