  In this work, we address the problem of synthesis of covert attackers in the
setup where the model of the plant is available, but the model of the
supervisor is unknown, to the adversary. To compensate the lack of knowledge on
the supervisor, we assume that the adversary has recorded a (prefix-closed)
finite set of observations of the runs of the closed-loop system, which can be
used for assisting the synthesis. We present a heuristic algorithm for the
synthesis of covert damage-reachable attackers, based on the model of the plant
and the (finite) set of observations, by a transformation into solving an
instance of the partial-observation supervisor synthesis problem. The heuristic
algorithm developed in this paper may allow the adversary to synthesize covert
attackers without having to know the model of the supervisor, which could be
hard to obtain in practice. For simplicity, we shall only consider covert
attackers that are able to carry out sensor replacement attacks and actuator
disablement attacks. The effectiveness of our approach is illustrated on a
water tank example adapted from the literature.
