# Joint State Estimation Under Attack of Discrete Event Systems

## TL;DR

This paper develops a method for estimating the current state of discrete event systems under cyber attacks that tamper with sensor observations, using a joint estimator that accounts for possible attack scenarios.

## Contribution

It introduces a joint estimator framework combining attacker and operator observers to detect and analyze malicious tampering in discrete event systems.

## Key findings

- Joint estimator effectively characterizes attack impacts.
- Method extends to attacks with bounded event insertions.
- Framework aids in identifying harmful attack functions.

## Abstract

The problem of state estimation in the setting of partially-observed discrete event systems subject to cyber attacks is considered. An operator observes a plant through a natural projection that hides the occurrence of certain events. The objective of the operator is that of estimating the current state of the system. The observation is corrupted by an attacker which can tamper with the readings of a set of sensors thus inserting some fake events or erasing some observations. The aim of the attacker is that of altering the state estimation of the operator. An automaton, called joint estimator, is defined to describe the set of all possible attacks. In more details, an unbounded joint estimator is obtained by concurrent composition of two state observers, the attacker observer and the operator observer. The joint estimator shows, for each possible corrupted observation, the joint state estimation, i.e., the set of states consistent with the uncorrupted observation and the set of states consistent with the corrupted observation. Such a structure can be used to establish if an attack function is harmful w.r.t. a misleading relation. Our approach is also extended to the case in which the attacker may insert at most n events between two consecutive observations.