Optimal Jamming Attack Scheduling in Networked Sensing and Control Systems

Abstract

This paper investigates the optimal jamming attack scheduling in Networked Sensing and Control Systems (NSCS). From viewpoint of the attacker, we formulate an optimization problem which maximizes the Linear Quadratic Gaussian (LQG) control cost with attacking energy constraint in a finite time horizon. For two special cases, we obtain that the optimal jamming attack schedule is to consecutively attack in the given time horizon. For the general case, we propose an algorithm to find the optimal schedules. Finally, we study the effectiveness of our proposed attack strategies on our established semiphysical testbed.

1. Introduction

Networked Sensing and Control Systems (NSCS) are control systems wherein physical elements, that is, plants, sensors, controllers, and actuators, are connected via wireless communication networks. NSCS have a wide range of applications in factory automation, unmanned aerial vehicles, remote surgery, intelligent transportation, smart grid, smart building, and so forth [1–5]. The essential characteristic of NSCS is that the physical elements and cyberspace are tightly integrated to carry out various jobs [6–8]. However, NSCS are vulnerable to an increasing number of malicious cyber attacks [9]. For example, an Iranian nuclear facility was attacked by “stuxnet” in 2010 and cannot operate normally in a long time since more than 60% of centrifugal control systems were destroyed [10].

In the past few years, several literatures have been focused on evaluating the effect of cyber attacks, for example, Denial-of-Service (DoS) attacks [11, 12], replay attacks [13, 14], and false data injection attacks [15, 16], on NSCS. Among these attacks, DoS attack is the most accomplishable one and can result in serious consequences [11]. Thus, it has been widely studied recently. In order to block the communication between system elements, DoS attacker can interfere with the radio frequencies on the communication channels [17]. In fact, jamming is a typical mode of DoS attack [18].

LQG control cost, which is used to synthetically consider the cost of system states and control, is an important performance in NSCS. Some researches have put emphasis on the security of LQG control under jamming attack [11, 19, 20]. Amin et al. study the optimal controller which minimize the LQG cost with safety and energy constraints when a jamming attacker takes identical independent distributed jamming actions [11]. They present semidefinite programming to solve this problem. Gupta et al. design an optimal controller to defense the intelligent jamming attack with limited actions [19]. Shisheh Foroush and Martinez propose an event-trigger control law which can prevent the periodic jamming attack with energy constraint [20]. The commonality of these works is that they all focus on the design of defense strategies under given attack patterns. However, our work stands in the viewpoint of attacker and finds the optimal attack schedules to maximize the control performance. This is of equal importance as one can provide effective defensive policies only when he grasps the attack strategies.

The goal of this paper is to design an optimal offline jamming schedule, which can maximize the attack effect on the NSCS. Specifically, in our scenario, one sensor observes the states of plant and sends the measurements to a remote estimator via a wireless channel. The attacker has a limited energy budget in the given finite time horizon. He has to decide whether or not to jam the channel from sensor to estimator at each time. The main contributions of this paper which distinguish it from the related literatures are summarized as follows:

• (1)

We formulate a jamming attack scheduling problem and look for the optimal jamming schedule that maximizes the LQG cost with energy constraint in a given finite time horizon.

(2)

We present the close form of the optimal jamming schedule for two special cases and provide an algorithm to search the optimal schedules for the general case.

(3)

We study the effectiveness of proposed jamming schedules on the established semiphysical testbed.

The remainder of the paper is organized as follows. In Section 2, we formulate the problem. In Section 3, we study the system performance under given attack schedule. In Section 4, we present the optimal jamming attack schedules for special cases and provide an algorithm to search the optimal attack schedules for the general case. In Section 5, we demonstrate the effectiveness of proposed optimal jamming schedules on the semiphysical testbed. Finally, Section 6 concludes the paper.

Notations. $\mathbb{E}[X]$ is the mean of random variable X, and $\mathbb{E}\left[X\hspace{0.17em}|\hspace{0.17em}Y\right]$ is the mean of random variable X conditioned on Y, respectively. $\mathrm{tr}(·)$ represents the trace of matrix. $X⪯Y$ means that $Y-X$ is nonnegative-definite; that is, $Y-X⪰\mathrm{0}$ .

2. Problem Formulation

2.1. System Architecture

Consider the following linear time-invariant system (Figure 1):

$$\begin{array}{cc}& x_{t+\mathrm{1}}=A{x}_t+u_t+w_t,\\ y_t=C{x}_t+v_t,\end{array}$$

(1)

where $x_t\in {\mathbb{R}}^{n_x}$ is the state of plant at time t, $y_t\in {\mathbb{R}}^{n_y}$ is the measurement from sensor, and $w_t$ and $v_t$ are uncorrelated zero mean Gaussian white noises with covariance ${\Sigma }_w$ and ${\Sigma }_v$ , respectively. The pair $(A,C)$ is assumed to be observable and $(A,{\Sigma }_w^{\mathrm{1}/\mathrm{2}})$ is controllable.

Figure 1

System architecture.

In our scenario, the sensor observes the plant and gets the measurements $y_t$ . According to these measurements, it preestimates the state $x_t$ and obtains the minimum mean squared error (MMSE) estimate; that is, ${\widehat{x}}_t^s=\mathbb{E}\left[x_t\hspace{0.17em}|\hspace{0.17em}{y}_{\mathrm{1}},\dots ,y_t\right]$ . Then the sensor sends these estimates to a remote estimator through a wireless channel. The controller then generates a control packet $u_t$ based on the received estimates and sends the control packet to the actuator through another dependable channel.

Let ${\theta }_t$ be the indicator function whether the packet ${\widehat{x}}_t^s$ is received or not by the estimator; that is,

$$\begin{array}{cc}& {\theta }_t=\left\{\begin{array}{cc}\mathrm{1},\hfill & \text{if\hspace{0.17em}\hspace{0.17em}}{\widehat{x}}_t^s\text{\hspace{0.17em}\hspace{0.17em}is received by the estimator};\hfill \\ \mathrm{0},\hfill & \text{otherwise}.\hfill \end{array}\right.\end{array}$$

(2)

Denote ${\mathcal{D}}_t$ by all the data received by estimator until time t; that is,

$$\begin{array}{cc}& {\mathcal{D}}_t=\left\{{\theta }_{\mathrm{1}},{\theta }_{\mathrm{2}},\dots ,{\theta }_t,{\theta }_{\mathrm{1}}{\widehat{x}}_{\mathrm{1}}^s,{\theta }_{\mathrm{2}}{\widehat{x}}_{\mathrm{2}}^s,\dots ,{\theta }_t{\widehat{x}}_t^s\right\}.\end{array}$$

(3)

Let ${\widehat{x}}_t$ be the minimum mean square error (MMSE) estimate in the estimator at time t; that is,

$$\begin{array}{cc}& {\widehat{x}}_t=\mathbb{E}\left[x_t\hspace{0.17em}|\hspace{0.17em}{\mathcal{D}}_t\right].\end{array}$$

(4)

The corresponding error covariance is

$$\begin{array}{cc}& P_t=\mathbb{E}\left[\left(x_t-{\widehat{x}}_t\right){\left(x_t-{\widehat{x}}_t\right)}^{\prime }\hspace{0.17em}|\hspace{0.17em}{\mathcal{D}}_t\right].\end{array}$$

(5)

Similar to [21], we have

$$\begin{array}{cc}& {\widehat{x}}_t=\left\{\begin{array}{cc}{\widehat{x}}_t^s,\hfill & \text{if\hspace{0.17em}\hspace{0.17em}}{\theta }_t=\mathrm{1};\hfill \\ A{\widehat{x}}_{t-\mathrm{1}}^s+B{u}_{t-\mathrm{1}},\hfill & \text{otherwise}.\hfill \end{array}\right.\end{array}$$

(6)

In order to minimize the LQG cost function

$$\begin{array}{cc}& J={\displaystyle \sum }_{t=\mathrm{0}}^{T-\mathrm{1}}\mathbb{E}\left[x_t^{\prime }Q{x}_t+u_t^{\prime }R{u}_t\right]+x_T^{\prime }Q{x}_T\end{array}$$

(7)

in the finite time horizon $[\mathrm{1},T]$ , where $Q⪰\mathrm{0}$ and $R\succ \mathrm{0}$ are two weighting matrices and the expectation is taken over $\{w_k\}$ , we exploit a linear static feedback controller of the form $u_k=L{\widehat{x}}_k$ . It is assumed that the system is unaware of the existence of attacker.

2.2. Attack Model

In our scenario, there is an attacker who wishes to deteriorate the control performance by jamming the sensor-to-estimator wireless channel. It is assumed that the attacker has a limited energy budget; that is, he can attack n times at most in the time horizon $[\mathrm{1},T]$ [22]. The attacker has to decide whether to attack or not at each sampling time in order to achieve his aim. Let ${\gamma }_t$ be the attack decision variable at time t; that is,

$$\begin{array}{cc}& {\gamma }_t=\left\{\begin{array}{cc}\mathrm{1},\hfill & \text{if attacker jams the wireless channel};\hfill \\ \mathrm{0},\hfill & \text{otherwise}.\hfill \end{array}\right.\end{array}$$

(8)

Similar to [18], we assume that the attack action is successful with probability α, and packet drop variables under attack are independent.

Specifically, from the viewpoint of attacker, he aims to maximize the cost function with energy constraint which is as follows.

Problem 1.

Consider

$$\begin{array}{cc}& \underset{\gamma \in \Theta }{\mathrm{m}\mathrm{a}\mathrm{x}}\hspace{1em}\mathbb{E}\left[J\left(\gamma \right)\right]\\ \text{s.t.}\hspace{1em}{\displaystyle \sum }_{t=\mathrm{1}}^T{\gamma }_t\le n,\end{array}$$

(9)

where $\gamma =({\gamma }_{\mathrm{1}},{\gamma }_{\mathrm{2}},\dots ,{\gamma }_T)$ is the attack schedule on the finite time horizon $[\mathrm{1},T]$ and $\Theta =\left\{\gamma \hspace{0.17em}|\hspace{0.17em}{\gamma }_t\in \left\{\mathrm{0,1}\right\},t=\mathrm{1,2},\dots ,T\right\}$ is the attack schedule space.

3. Preliminaries

In this section, we present some properties of the estimate at the estimator side and the control performance of plant under a jamming attack.

3.1. State Estimation under Jamming Attack

From standard Kalman filter, the estimate and corresponding error covariance at the sensor side can be calculated as follows:

$$\begin{array}{cc}& {\widehat{x}}_{t\hspace{0.17em}|\hspace{0.17em}t-\mathrm{1}}^s=A{\widehat{x}}_{t-\mathrm{1}}^s+u_{t-\mathrm{1}},\\ P_{t\hspace{0.17em}|\hspace{0.17em}t-\mathrm{1}}^s=A{P}_{t-\mathrm{1}}^s{A}^{\prime }+{\Sigma }_w,\\ K_t^s=P_{t\hspace{0.17em}|\hspace{0.17em}t-\mathrm{1}}^s{C}^{\prime }{\left[C{P}_{t\hspace{0.17em}|\hspace{0.17em}t-\mathrm{1}}^s{C}^{\prime }+{\Sigma }_v\right]}^{-\mathrm{1}},\\ {\widehat{x}}_t^s=A{\widehat{x}}_{t-\mathrm{1}}^s+K_t^s\left(y_t-C{\widehat{x}}_{t\hspace{0.17em}|\hspace{0.17em}t-\mathrm{1}}^s\right),\\ P_t^s=\left(I-K_t^{s}C\right)P_{t\hspace{0.17em}|\hspace{0.17em}t-\mathrm{1}}^s,\end{array}$$

(10)

where the initial state is ${\widehat{x}}_{\mathrm{0}}=\mathrm{0}$ , and $P_{\mathrm{0}}^s={\Pi }_{\mathrm{0}}$ . From [23], we can see that the error covariance $P_t^s$ converges exponentially to its steady-state value $\bar{P}$ . Thus, we assume that ${\Pi }_{\mathrm{0}}=\bar{P}$ . It can be seen that $P_t^s=\bar{P}$ for all $t\in [\mathrm{1},T]$ .

Define functions $h,h^t$ as $h(X)\triangleq AX{A}^{\prime }+{\Sigma }_w$ and $h^t(X)\triangleq \underset{t\hspace{0.17em}\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}\mathrm{s}}{\underbrace{h\circ h\circ \cdots \circ h}}(X)$ .

From [23], the following result holds.

Lemma 2.

The function h has the following property:

$$\begin{array}{cc}& \bar{P}⪯h\left(\bar{P}\right)⪯h^{\mathrm{2}}\left(\bar{P}\right)⪯\cdots ⪯h^t\left(\bar{P}\right)⪯\cdots ,\hspace{1em}\forall t\in {\mathbb{Z}}^{+}.\end{array}$$

(11)

From [22], we can obtain the estimate ${\widehat{x}}_t$ and error covariance $P_t$ at estimator side as follows:

$$\begin{array}{cc}& \left({\widehat{x}}_t,P_t\right)=\left\{\begin{array}{cc}\left(A{\widehat{x}}_{t-\mathrm{1}}+u_{t-\mathrm{1}},h\left(P_{t-\mathrm{1}}\right)\right),\hfill & \text{if\hspace{0.17em}\hspace{0.17em}}{\gamma }_t=\mathrm{1},{\theta }_t=\mathrm{1},\hfill \\ \left({\widehat{x}}_t^s,\bar{P}\right),\hfill & \text{otherwise}.\hfill \end{array}\right.\end{array}$$

(12)

Define attack sequence $(k_{\mathrm{1}},k_{\mathrm{2}},\dots ,k_s)$ as the attack schedules which has the following form:

$$\begin{array}{cc}& \left(\mathrm{0},\dots ,\mathrm{0},\underset{k_{\mathrm{1}}\text{\hspace{0.17em}times}}{\underbrace{\mathrm{1},\dots ,\mathrm{1}}},\mathrm{0},\dots ,\mathrm{0},\underset{k_{\mathrm{2}}\text{\hspace{0.17em}times}}{\underbrace{\mathrm{1},\dots ,\mathrm{1}}},\mathrm{0},\dots ,\mathrm{0},\underset{k_s\text{\hspace{0.17em}times}}{\underbrace{\mathrm{1},\dots ,\mathrm{1}}},\mathrm{0},\dots ,\mathrm{0}\right).\end{array}$$

(13)

Similar to [18, 22], one can get the following result.

Lemma 3.

Let $E(k_{\mathrm{1}}\otimes k_{\mathrm{2}}\otimes \cdots \otimes k_s)$ be the average expected error covariance in time horizon $[\mathrm{1},T]$ under attack sequence $(k_{\mathrm{1}},k_{\mathrm{2}},\dots ,k_s)$ at estimator side, and let $E(k)$ be the average expected error covariance under attack sequence $(k)$ . The following statements are true:

• (1)

$E(k_{\mathrm{1}})⪯E(k_{\mathrm{2}})$ , where $k_{\mathrm{1}}<k_{\mathrm{2}}$ .

(2)

$E(k_{\mathrm{1}}\otimes k_{\mathrm{2}}\otimes \cdots \otimes k_s)⪯E(k)$ , where $k=k_{\mathrm{1}}+k_{\mathrm{2}}+\cdots +k_s$ .

(3)

$E(k_{\mathrm{1}}\otimes k_{\mathrm{2}})⪯E(l_{\mathrm{1}}\otimes l_{\mathrm{2}})$ , where $k_{\mathrm{1}}+k_{\mathrm{2}}=l_{\mathrm{1}}+l_{\mathrm{2}}$ and $\mathrm{m}\mathrm{a}\mathrm{x}\{k_{\mathrm{1}},k_{\mathrm{2}},l_{\mathrm{1}},l_{\mathrm{2}}\}$ is $l_{\mathrm{1}}$ or $l_{\mathrm{2}}$ .

From Lemma 3, we can see that grouping together as much as possible can lead to maximal average error covariance.

3.2. Control Performance under Jamming Attack

In order to find the optimal offline jamming attack scheduling, we have to study the control performance when the attack schedule is given.

According to [5, 24], one can obtain the following result.

Lemma 4.

The LQG control cost function under a given attack schedule γ can be calculated as follows:

$$\begin{array}{cc}& J\left(\gamma \right)=\mathrm{tr}\left(S_{\mathrm{0}}{P}_{\mathrm{0}}\right)+{\displaystyle \sum }_{t=\mathrm{0}}^{T-\mathrm{1}}\mathrm{tr}\left(S_{t+\mathrm{1}}{\Sigma }_w\right)+{\displaystyle \sum }_{t=\mathrm{0}}^{T-\mathrm{1}}\mathrm{tr}\left[\left(A^{\prime }{S}_{t+\mathrm{1}}A+Q-S_t\right)E_{\gamma }\left(P_t\right)\right],\end{array}$$

(14)

where $S_t$ can be computed from the following recursive equation:

$$\begin{array}{cc}& S_t=A^{\prime }{S}_{t+\mathrm{1}}A+Q-A^{\prime }{S}_{t+\mathrm{1}}{\left(S_{t+\mathrm{1}}+R\right)}^{-\mathrm{1}}{S}_{t+\mathrm{1}}A,\hspace{1em}t=\mathrm{0,1},\dots ,T-\mathrm{1}.\end{array}$$

(15)

In fact, (15) converges quickly to a steady state. Thus, if $T\to \infty$ , one can see that

$$\begin{array}{cc}& S=A^{\prime }SA+Q-A^{\prime }S{\left(S+R\right)}^{-\mathrm{1}}SA,\end{array}$$

(16)

where $S={\mathrm{l}\mathrm{i}\mathrm{m}}_{T\to \infty }{S}_T$ . In practice, we often choose $u_t=L{\widehat{x}}_t$ with control gain $L=-(S+R{)}^{-\mathrm{1}}SA$ as the optimal static state feedback controller to maximize the cost $J_{\infty }={\mathrm{l}\mathrm{i}\mathrm{m}}_{T\to \infty }J$ . In our scenario, we assume that the system has reached steady state; that is, $S_{\mathrm{0}}=S$ , and $P_{\mathrm{0}}=\bar{P}$ . Then (14) can be rewritten as

$$\begin{array}{cc}& J\left(\gamma \right)=J_c+J_e,\end{array}$$

(17)

where

$$\begin{array}{cc}& J_c=\mathrm{tr}\left(S\bar{P}\right)+N·\mathrm{tr}\left(S{\Sigma }_w\right),\\ J_e={\displaystyle \sum }_{t=\mathrm{0}}^{T-\mathrm{1}}\mathrm{tr}\left[\left(A^{\prime }SA+Q-S\right){\mathbb{E}}_{\gamma }\left(P_t\right)\right].\end{array}$$

(18)

It can be seen that $J_c$ and $J_e$ are the constant part and varying part of (17), respectively. Thus, we only have to study the optimal jamming attack schedule which maximizes $J_e$ which is as follows.

Problem 5.

Consider

$$\begin{array}{cc}& \underset{\gamma \in \Theta }{\max }\hspace{1em}\mathbb{E}\left[J_e\left(\gamma \right)\right]\\ \text{s.t.}\hspace{1em}{\displaystyle \sum }_{t=\mathrm{1}}^T{\gamma }_t\le n.\end{array}$$

(19)

4. Optimal Jamming Attack Schedules

In this section, we firstly study the jamming schedules against LQG control for two special cases and present the close form of optimal schedules. Then we investigate the attack strategies for the general case.

4.1. Case I: $R=\mathrm{0}$

When $R=\mathrm{0}$ , it can be seen that the LQG cost function becomes

$$\begin{array}{cc}& J={\displaystyle \sum }_{t=\mathrm{0}}^T\mathbb{E}\left[x_t^{\prime }Q{x}_t\right].\end{array}$$

(20)

From Lemma 4, we can obtain the following conclusion.

Theorem 6.

If $R=\mathrm{0}$ , the optimal state feedback controller is $u_t=L{\widehat{x}}_t=-A{\widehat{x}}_t$ , and the corresponding LQG cost function under attack schedule γ is

$$\begin{array}{cc}& J=J_c+J_e,\end{array}$$

(21)

where

$$\begin{array}{cc}& J_c=\mathrm{tr}\left(Q\bar{P}\right)+N·\mathrm{tr}\left(Q{\Sigma }_w\right),\\ J_e={\displaystyle \sum }_{t=\mathrm{0}}^{T-\mathrm{1}}\mathrm{tr}\left[A^{\prime }QA{\mathbb{E}}_{\gamma }\left(P_t\right)\right].\end{array}$$

(22)

According to Theorem 6, we can see that the attacker only needs to maximize $\mathbb{E}[J_e]$ . Since $A^{\prime }QA⪰\mathrm{0}$ , one can obtain that ${\mathrm{m}\mathrm{a}\mathrm{x}}_{\gamma }\mathbb{E}[J_e]$ is equivalent to ${\mathrm{m}\mathrm{a}\mathrm{x}}_{\gamma }\mathbb{E}[{\sum }_{t=\mathrm{0}}^{N-\mathrm{1}}{P}_t(\gamma )]$ . Thus, from viewpoint of attacker, we only have to solve the following problem.

Problem 7.

Consider

$$\begin{array}{cc}& \underset{\gamma \in \Theta }{\max }\hspace{1em}\mathbb{E}\left[{\displaystyle \sum }_{t=\mathrm{0}}^{N-\mathrm{1}}{P}_t\left(\gamma \right)\right]\\ \text{s.t.}\hspace{1em}{\displaystyle \sum }_{t=\mathrm{1}}^T{\gamma }_t\le n.\end{array}$$

(23)

From [18, 22], Problem 7 can be easily solved by the following theorem.

Theorem 8.

When $R=\mathrm{0}$ , the optimal attack schedules are any consecutive attack n times in time horizon $[\mathrm{1},T]$ , and the corresponding expected LQG cost function is

$$\begin{array}{cc}& \mathbb{E}\left(J\right)=J_c+J_e^{\max },\end{array}$$

(24)

where

$$\begin{array}{cc}& J_e^{\max }={\displaystyle \sum }_{i=\mathrm{1}}^T\mathrm{tr}\left[g_i\left(\bar{P}\right)\right]+\left(T-n\alpha \right)\mathrm{tr}\left[M\bar{P}\right],\end{array}$$

(25)

with $M=A^{\prime }QA$ and $g_i(\bar{P})=M{h}^i(\bar{P})$ .

4.2. Case II: $S_{\mathrm{0}}=S$

Define $\bar{M}=A^{\prime }SA+Q-S$ , and ${\bar{g}}_i(\bar{P})=\bar{M}{h}^i(\bar{P})$ , $i=\mathrm{1,2},\dots$ . Then we have following lemma.

Lemma 9.

The function $\bar{g}$ has the following property:

$$\begin{array}{cc}& {\bar{g}}_{\mathrm{1}}\left(\bar{P}\right)⪯{\bar{g}}_{\mathrm{2}}\left(\bar{P}\right)⪯\cdots ⪯{\bar{g}}_i\left(\bar{P}\right)⪯\cdots .\end{array}$$

(26)

According to Section 3.2, the objective of Problem 1 is equivalent to ${\mathrm{m}\mathrm{a}\mathrm{x}}_{\gamma }\mathbb{E}[{\sum }_{t=\mathrm{0}}^{N-\mathrm{1}}{P}_t(\gamma )]$ . Thus, from the viewpoint of attacker, we only have to solve Problem 7 for the case $S_{\mathrm{0}}=S$ .

From Lemma 9 and Theorem  3.1 in [22], we can solve this problem by the following theorem.

Theorem 10.

When $S_{\mathrm{0}}=S$ , the optimal attack schedules are any consecutive attack n times in time horizon $[\mathrm{1},T]$ , and the corresponding expected LQG cost function is

$$\begin{array}{cc}& \mathbb{E}\left(J\right)=J_c+J_e^{\max },\end{array}$$

(27)

where

$$\begin{array}{cc}& J_e^{\max }={\displaystyle \sum }_{i=\mathrm{1}}^T\mathrm{tr}\left[{\bar{g}}_i\left(\bar{P}\right)\right]+\left(T-n\alpha \right)\mathrm{tr}\left[\bar{M}·\bar{P}\right].\end{array}$$

(28)

4.3. General Case Study

For the general case, it is difficult to obtain a close form of optimal attack schedule. Attacker can find the optimal jamming schedule by exhaustion method which is given in Algorithm 1. Since this schedule can be computed before the attack action begins, the computation of our proposed algorithm will not cost too much.

Algorithm 1: Optimal offline attack schedule.

(1) Process begins;

(2) Input: $H_{\mathrm{t}\mathrm{i}\mathrm{m}\mathrm{e}}=T$ ; ${\mathrm{\Pi }}_{\mathrm{0}}=\bar{P}$ ; $J^{\ast }=\mathrm{0}$ ;

(3) for   ${\mathrm{\gamma }}_{\mathrm{1}}+{\mathrm{\gamma }}_{\mathrm{2}}+\cdots +{\mathrm{\gamma }}_T=n$   do

(4)  Compute LQG cost (14) under attack schedule γ, that is $J=J(\mathrm{\gamma })$

(5)  if   $J>J^{\ast }$   then

(6)     $J^{\ast }=J$ , and ${\mathrm{\gamma }}^{\ast }=({\mathrm{\gamma }}_{\mathrm{1}},{\mathrm{\gamma }}_{\mathrm{2}},\dots ,{\mathrm{\gamma }}_T)$

(7)  end if

(8) end for

(9) Output: optimal attack schedule ${\mathrm{\gamma }}^{\ast }$ , and corresponding cost $J^{\ast }$ .

5. Simulation

5.1. Testbed

There are three types testbeds for simulation of NSCS security, that is, software simulation testbeds, physical simulation testbeds, and semiphysical simulation testbeds. The software simulation testbeds cannot fully simulate the real environment. The physical simulation testbeds can employ the same experimental equipment with the real world to construct the security test platform. However, they need long cycle of construction and great cost. Fortunately, semiphysical simulation testbeds are the good choice for NSCS security since they can simulate the real working environment and save the cost. Thus, we choose a semiphysical simulation testbed to study the effectiveness of our proposed attack strategy.

Our semiphysical simulation testbed is composed of virtual plant, physical controller, and communication network. Figure 2 shows the system architecture. In our testbed, real-time system states of the virtual plant are sent to the PLC through a wireless network. After reading the system states, the controller calculates the control data and writes them back to the PLC. Then the control data are sent back to the virtual plant via a wired channel.

Figure 2

The structure of semiphysical testbed.

We build an inverted pendulum control system for experiments, which is based on the system presented in [5]. The parameters are given as follows:

$$\begin{array}{cc}& A=\left(\begin{array}{cccc}\mathrm{1.001}& \mathrm{0.005}& \mathrm{0.000}& \mathrm{0.000}\\ \mathrm{0.350}& \mathrm{1.001}& -\mathrm{0.135}& \mathrm{0.000}\\ -\mathrm{0.001}& \mathrm{0.000}& \mathrm{1.001}& \mathrm{0.005}\\ -\mathrm{0.375}& -\mathrm{0.001}& \mathrm{0.590}& \mathrm{1.001}\end{array}\right),\\ B=\left(\begin{array}{c}\mathrm{0.001}\\ \mathrm{0.540}\\ -\mathrm{0.002}\\ -\mathrm{1.066}\end{array}\right),\\ {\Sigma }_w=q{q}^{\prime },\hspace{1em}q=\left(\begin{array}{c}\mathrm{0.003}\\ \mathrm{1.000}\\ -\mathrm{0.005}\\ -\mathrm{2.150}\end{array}\right),\\ Q=\left(\begin{array}{cccc}\mathrm{5}& \mathrm{0}& \mathrm{0}& \mathrm{0}\\ \mathrm{0}& \mathrm{1}& \mathrm{0}& \mathrm{0}\\ \mathrm{0}& \mathrm{0}& \mathrm{1}& \mathrm{0}\\ \mathrm{0}& \mathrm{0}& \mathrm{0}& \mathrm{1}\end{array}\right).\end{array}$$

(29)

We employ USRP N210 to simulate jamming attack on the wireless channel from sensor to controller. USRP is a universal software radio peripheral that can send and receive radio signal. We use the software GNU Radio in Ubuntu to manipulate the USRP. The frequency spectrum analyzer is adopted to detect the central frequency and waveform of transmission signals. Then we adapt the parameters on GNU Radio to configure the USRP. Experimental parameters are set as follows: center frequency is 433 MHz; waveform is saw tooth; jamming power is 16 dB and jamming signal frequency is 10k; bandwidth is 20 MHz.

We verify the proposed optimal offline attack strategies through experiments based on the semiphysical testbed. We set $T=\mathrm{250}$ and the attack times $n=\mathrm{10}$ in the finite time horizon $[\mathrm{1,250}]$ . It means that the attacker can assign the 10 times of attack in this period.

5.2. Simulation Results Analysis

We study the effectiveness of jamming attack with 10 different schedules when $R=\mathrm{0}$ , $S_{\mathrm{0}}=S$ , respectively (see Table 1). From Figure 3(a), we can compare the cost J under different attack schedules when $R=\mathrm{0}$ . It can be seen that the attack schedule with 10 consecutive attack times can maximize the LQG cost. We also present the variation of system states and control data under optimal attack schedule in Figure 4. From this figure, these data will deviate the equilibrium points when the wireless channel is under jamming attack. Similarly, we can also study the LQG cost J under different attack schedules when $S_{\mathrm{0}}=S$ . From Figure 3(b), we also can see that consecutive attack schedule is optimal. These experimental results can verify the theoretical conclusions in Section 4.

Table 1

Attack schedules in our experiment.

Mark number	1	2	3	4	5
Attack sequence	No attack	$(\mathrm{1,2},\mathrm{3,4})$	$(\mathrm{6,3},\mathrm{1})$	$(\mathrm{4,4},\mathrm{2})$	$(\mathrm{5,5})$
Mark number	6	7	8	9	10
Attack sequence	$(\mathrm{4,6})$	$(\mathrm{7,3})$	$(\mathrm{8,2})$	$(\mathrm{9,1})$	(10)

Figure 3

Compare the cost J under different attack strategies. The lateral axis is the mark number of attack strategy. Attack strategy 10 is the consecutive attack strategy.

Figure 4

The variation of system states and control data under attack schedule 10 (optimal attack) when $R=\mathrm{0}$ .

6. Conclusion

In this paper, we considered the optimal jamming attack scheduling which can destroy the system control performance. We formulated an optimization problem that maximizes the LQG cost subject to attacker's energy constraint in a given finite time horizon. Optimal attack schedule has been presented for two special cases. For the general case, we provided an algorithm to find the optimal attack schedule. We also established a semiphysical testbed and studied the effectiveness of proposed attack schedules by simulation. In the future, we will study the evaluation of control performance when the NSCS is under other types of cyber attack, for example, data injection attack and replay attack. We will also design effective defense strategies to avoid the cyber attacks in NSCS.