Observation-Assisted Heuristic Synthesis of Covert Attackers Against Unknown Supervisors

TL;DR

This paper proposes a heuristic method for synthesizing covert attackers in control systems where the attacker knows the plant model but not the supervisor, using recorded observations to guide attack synthesis.

Contribution

It introduces a novel heuristic algorithm that enables covert attacker synthesis without requiring the supervisor model, based on partial observations and plant model transformation.

Findings

Effective in synthesizing covert attackers using finite observations

Applicable to sensor replacement and actuator disablement attacks

Demonstrated on a water tank control system example

Abstract

In this work, we address the problem of synthesis of covert attackers in the setup where the model of the plant is available, but the model of the supervisor is unknown, to the adversary. To compensate the lack of knowledge on the supervisor, we assume that the adversary has recorded a (prefix-closed) finite set of observations of the runs of the closed-loop system, which can be used for assisting the synthesis. We present a heuristic algorithm for the synthesis of covert damage-reachable attackers, based on the model of the plant and the (finite) set of observations, by a transformation into solving an instance of the partial-observation supervisor synthesis problem. The heuristic algorithm developed in this paper may allow the adversary to synthesize covert attackers without having to know the model of the supervisor, which could be hard to obtain in practice. For simplicity, we shall only consider covert attackers that are able to carry out sensor replacement attacks and actuator disablement attacks. The effectiveness of our approach is illustrated on a water tank example adapted from the literature.