  In this paper, we investigate the covert sensor attack synthesis problem in
the framework of supervisory control of networked discrete-event systems (DES),
where the observation channel and the control channel are assumed to be
non-FIFO and have bounded network delays. We focus on the class of sensor
attacks satisfying the following properties: 1) the attacker might not have the
same observation capability as the networked supervisor; 2) the attacker aims
to remain covert, i.e., hide its presence against the networked monitor; 3) the
attacker could insert, delete, or replace compromised observable events; 4) it
performs bounded sensor attacks, i.e., the length of each string output of the
sensor attacker is upper bounded by a given constant. The solution methodology
proposed in this work is to solve the covert sensor attack synthesis problem
for networked DES by modeling it as the well studied Ramadge-Wonham supervisor
synthesis problem, and the constructions work for both the damage-reachable
attacks and the damage-nonblocking attacks. In particular, we show the supremal
covert sensor attack exists in the networked setup and can be effectively
computed by using the normality property based synthesis approach.
