Stealthy Deception Attacks for Cyber-Physical Systems

Transcription

1 2017 IEEE 56th Annul Conferene on Deision nd Control (CDC) Deemer 12-15, 2017, Melourne, Austrli Stelthy Deeption Attks for Cyer-Physil Systems Rômulo Meir Góes, Eunsuk Kng, Rymond Kwong nd Stéphne Lfortune Astrt We study the seurity of Cyer-Physil Systems (CPS) in the ontext of the supervisory ontrol lyer. Speifilly, we propose generl model of CPS ttker in the frmework of Disrete Event Systems (DES) nd investigte the prolem of synthesizing n ttk strtegy for given ontrolled system. Our model ptures lss of deeption ttks, where the ttker hs the ility to modify suset of sensor redings nd misled the supervisor, with the gol of induing the system into n undesirle stte. We introdue new type of iprtite trnsition struture, lled Insertion-Deletion Attk struture (IDA), to pture the gme-like intertion etween the supervisor nd the environment (whih inludes the system nd ttker). This struture is disrete trnsition system tht emeds informtion out ll possile ttker s stelthy tions, nd ll sttes (some possily unsfe) tht eome rehle s result of those tions. We present proedure for the onstrution of the IDA nd disuss its properties. Bsed on the IDA, we disuss the hrteriztion of suessful stelthy ttks, i.e., ttks tht void detetion from the supervisor nd use dmge to the system. I. INTRODUCTION In this pper, we re onerned with the prolem of synthesizing n ttk strtegy t the supervisory ontrol lyer of given Cyer-Physil Systems (CPS). Previously, some efforts were mde in lssifition nd modeling of yer-ttks, ssuming ertin intelligene on the prt of the ttker; see, e.g., [1], [2]. Our fous is speil type of ttks, lled deeption ttks, whih re hrterized y some type of mnipultion of the sensor mesurements reeived y the ontroller/supervisor. Given tht we re investigting yer-ttks t the supervisory ontrol lyer of CPS, we use the formlism of Disrete Event Systems (DES) to model oth the ttker s ehvior s well s the CPS ehvior itself. This llows us to leverge the onepts nd tehniques of the theory of supervisory ontrol of DES. Severl reent works hve dopted similr pprohes to study yer-seurity issues in CPS; see, e.g., [3], [4], [5], [6]. Previous works [3], [4], [5] on intrusion detetion nd prevention of yer-ttks using disrete event models were foused on modeling the ttker s fulty ehvior nd their orresponding methodologies were relying on fult dignosis tehniques. Reently, [7] proposed frmework similr to the This work ws supported in prt y the U.S. Ntionl Siene Foundtion grnt CNS Rômulo Meir Góes, Eunsuk Kng, nd Stéphne Lfortune re with Deprtment of Eletril Engineering nd Computer Siene, University of Mihign, Ann Aror, MI 48105, USA {romulo,eskng,stephne}@umih.edu Rymond Kwong is with the Deprtment of Eletril Engineering nd Computer Siene, University of Toronto, Toronto, ON M5S 3G4, Cnd kwong@ontrol.utoronto. one dopted in our pper, where they formulte model of dt deeption ttks. However, our methodology is more generl thn tht in [7], s it llows ritrry insertions or deletions of events. Furthermore, in [7], normlity ondition is neessry to rete the ttk strtegy; this ondition is imposed to otin the so-lled supreml ontrollle nd norml lnguge under the ttk model. In our pproh, this ondition is relxed, nd normlity is not neessry to rete n ttk strtegy, thus llowing lrger lss of ttks strtegies. In [6], the uthors presented study of supervisory ontrol of DES under ttks. They introdued new notion of oservility whih ptures the presene of n ttker. However, their study is foused on the supervisor s viewpoint nd they do not develop methodology to design ttk strtegies. They ssume tht the ttker s model is given nd they develop their results sed on tht ssumption. In tht sense, the work [6] is loser to roust supervisory ontrol nd it is omplementry to our work. Severl prior works onsidered roust supervisory ontrol under different notions of roustness [8], [9], [10], [11], ut they did not study roustness ginst ttks. In the yer-seurity literture, some works hve een rried out in the ontext of disrete event models, espeilly regrding opity nd privy/serey properties [12], [13], [14], [15]. These works re onerned with studying informtion relese properties y the system, nd they do not ddress the impt of n intruder over the physil prts of the system. In this pper, we propose model of deeption ttks t the supervisory ontrol lyer nd introdue the generl prolem of synthesis of suessful stelthy deeption ttks. We ssume n ttker with (i) knowledge of oth the system nd its supervisor nd (ii) ility to ffet the sensor informtion tht is reeived y the supervisor. The gol of the ttker is to indue the supervisor into llowing the system to reh n unsfe stte, therey using dmge to the system. The set of unsfe sttes is ssumed to e prespeified. The methodology tht we develop for investigting the synthesis of suh ttks is inspired y the work in [16], [17], [15]; s in these works, we employ iprtite disrete struture to model the gme-like intertion etween the supervisor nd the environment (system nd ttker). We ll our new struture the All Stelthy Insertion-Deletion Attk struture (or IDA). By onstrution, the IDA emeds ll possile senrios where the ttker inserts or deletes some suset of oservle events without eing notied y the supervisor. The IDA, one onstruted, serves s the sis for solving the synthesis prolem. By providing generl nlysis nd synthesis frmework, our gol is to llow CPS engineers to detet nd /17/$ IEEE 4224

2 ddress potentil vulnerilities in their ontrolled systems. To demonstrte our pproh, we performed se study on the seurity of relisti, fully opertionl wter tretment tested investigted in prior relted reserh [18]. The reminder of this pper is orgnized s follow. Setion II introdues neessry kground nd some nottions. Setion III formlizes the ttk model s well s the prolem sttement. Setion IV desries the IDA struture nd its properties. Setion V riefly desries results in the se study. Lstly, Setion VI provides onlusions nd diretions for future work. II. MODELING FORMALISM We use the formlism of DES modeled s finite stte utomt. A Finite-Stte Automton G is defined s tuple G = (X,Σ,δ,x 0 ), where X is finite set of sttes; Σ is finite set of events; δ : X Σ X is prtil trnsition funtion; x 0 X is the initil stte. The funtion δ is extended in the usul mnner to domin X Σ. The lnguge generted y G is defined s L (G) = {s Σ δ(x 0,s)!}, where! mens is defined. Lnguge L (G) is onsidered s the unontrolled system ehvior, sine it inludes ll possile exeutions of G. We ssume tht supervisor S P ws designed to enfore some sfety nd/or nonlokingness (or liveness) property on G. In the nottion of the theory of supervisory ontrol of DES initited in [19], the resulting ontrolled ehvior is new DES denoted y S P /G, resulting in the losed-loop lnguge L (S P /G), defined in the usul mnner [20]. S P dynmilly enles nd disles the ontrollle events of G (i.e., the tutors), on the sis of the oservle events of G tht it trks (from the sensors of G). The limited tution pilities of G re modeled y prtition in the event set Σ = Σ Σ u, where Σ u is the set of unontrollle events nd Σ is the set of ontrollle events. The set of dmissile ontrol deisions is defined s Γ = {γ 2 Σ : Σ u γ}, where dmissiility gurntees tht ontrol deision will never disle n unontrollle event. In ddition, when the system is prtilly oserved due to the limited sensing pilities of G, the event set is lso prtitioned into Σ = Σ o Σ uo, where Σ o is the set of oservle events nd Σ uo is the set of unoservle events. Bsed on this seond prtition, the projetion funtion P : Σ Σ o is defined s : { P(s)e if e Σ o P(ε) = ε nd P(se) = (1) P(s) if e Σ uo The inverse projetion P 1 : Σ o 2 Σ is defined s P 1 (t) = {s Σ P(s) = t}. In ddition, Γ G (S) is defined s the set of tive events t the suset of sttes S X of utomton G, given y: Γ G (S) := {e Σ ( u S) s.t. δ(u,e)!} (2) The supervisor S P mkes its deisions sed on the string of oservle events tht it oserves. Formlly, prtilly () G 2 A C B D () Supervisor R 1 Fig. 1: System utomton long with its supervisor oservtion supervisor is funtion S P : P(L (G)) Γ. Without loss of generlity, we ssume tht S P is relized s deterministi utomton R = (Q,Σ, µ,q 0 ) suh tht q Q, if e Σ uo is n enled unoservle event t stte q y S P, then we define µ(q,e) = q s is ustomry in supervisor reliztion (f. [20]). This mens tht the supervisor n only hnge its ontrol deision (y updting the stte in R) upon the ourrene of n oservle event; yet, its tive event set is the tul ontrol deision issued to the system, inluding the enled unoservle events. More expliitly, the urrent ontrol deision pplied to G is Γ R ({q}), where Γ R is set of tive events t stte q of R. Thus, while the domin of events in R is Σ not Σ o, its trnsitions will only e driven y the strings of oservle events tht it reeives from the ttker. We lso define R = ( Q,Σ, µ,q 0 ), where Q = Q {ded}, nd µ is defined y ompleting the prtil trnsition funtion µ s ( q Q) ( e [Σ o \Γ R ({q})]) µ(q,e) = ded. The stte ded will llow us to pture when the ontrolled system goes out of rnge of the losed-loop ehvior for whih S P ws designed; t the sme time, this stte will pture when the supervisor detets tht it is under ttk. Exmple II.1. Consider the system G represented in Fig. 1(). Let Σ = Σ o = {,,} nd Σ = {,}. Figure 1() shows the reliztion R 1 of supervisor S P1 tht ws designed for G. In this se, the lnguge generted y L (S P1 /G) gurntees tht stte 2 is unrehle in the ontrolled ehvior. Next, let us onsider tht Σ o = {,} nd Σ = {,}. A reliztion R 2 of supervisor S P2 is shown in Fig. 2. The ontrolled ehvior remins the sme s the previous se. A C B D Fig. 2: Supervisor R 2 For onveniene, we define two opertors tht will e used in this pper. The unoservle reh of the suset of sttes S X under the suset of events γ Σ is given y: UR γ (S) := {x X ( u S)( e (Σ uo γ) s.t. x = δ(u,e)} (3) The oservle reh of the suset of sttes S X given the 4225

3 exeution of the oservle event e Σ o is defined: Next e (S) := {x X u S s.t. x = δ(u,e)} (4) III. PROBLEM STATEMENT In this setion, we formulte the Stelthy Insertion- Deletion Sensor Attk Prolem. Let us first define how n ttker interts with the ontrolled system. Figure 3 Fig. 3: Closed loop system under Deeption Attk shows ontrolled system under ttk, where the ttker intervenes in the ommunition hnnel etween the plnt s sensors nd the supervisor. Speifilly, the ttker hs the ility to oserve the sme oservle events s the supervisor. Moreover, we ssume tht the ttker possesses the ility to lter some of the sensors redings in this ommunition hnnel. By ltering, we men tht it my insert or delete some suset of sensor redings sent to the supervisor; this suset is defined s the ompromised event set Σ Σ o. Formlly, we model n ttker with suh pilities s string edit funtion. Definition III.1. Given system G nd suset Σ Σ o, n ttker is defined s funtion f A : P(L (G)) (Σ o {ε}) Σ o s.t. f A stisfies the following onstrints: f A (ε,ε) Σ ; s P(L (G)), e Σ o \Σ : f A (s,e) {e}σ ; s P(L (G)), e Σ : f A (s,e) Σ. The funtion f A ptures generl model of deeption ttk. Given the pst output string s of G nd oserving new event e, the ttker my hoose to edit e if it elongs to Σ. The first se in the ove definition gives n initil ondition for n ttk. The seond se onstrins the ttker to e unle to erse e when e is outside of Σ. However, the ttker my insert n ritrry string t Σ fter the ourrene of e. Lstly, the third se in Definition III.1 mens event e Σ is edited to some string t Σ, pturing the deletion of e s well s the insertion of t. Note tht in this third se: (i) t my e equl to e, llowing the ttker to leve the event unmodified if it hooses to do so; (ii) e my e the first event of t, mening tht e is not deleted. For onveniene, let us define string-sed edit (prtil) funtion ˆf A : P(L (G)) Σ o reursively s ˆf A (te) = ˆf A (t) f A (t,e), nd ˆf A (ε) = f A (ε,ε). The existene of n ttker in the ontrolled system indues new ontrolled lnguge. More speifilly, S P nd ˆf A together effetively generte new supervisor S A for system G. Formlly, for ny s P(L (G)), S A (s) = [S P ˆf A (s)], from whih new ontrolled lnguge L (S A /G) is onstruted (in the usul mnner in supervisory ontrol theory). The omposition opertion ptures the new edited oserved string tht now drives S P in the presene of the ttker. Next, let us onsider the ojetive for n ttker. We ssume tht the system G ontins set of ritil unsfe sttes defined s X rit X suh tht x X rit,( s = e 1...e n L (G) s.t. δ(x 0,s) = x s = n)( i {1,...,n 1}): e i+1 / S P (P o (e 1...e i )). In generl, not ll sttes rehed y strings of G tht re disled y S P re ritilly unsfe. In prtie, there will e ertin sttes mong those tht fore the supervisor to go out of rnge tht orrespond to physil dmge to the system, suh s overflow sttes or ollision sttes, for instne. Similr notions of ritil unsfe sttes hve een used in other works, e.g., [21], [4]. Therefore, the ojetive of the ttker is to fore the ontrolled ehvior under ttk L (S A /G) to reh ny stte in X rit. At the sme time, the ttker does not wish to e deteted y S P, mening tht reliztion R should never enter the stte ded. Prolem III.1 (Synthesis of Stelthy Deeption Attks). Given system G, supervisor S P relized s n utomton R, nd set of ompromised events Σ Σ o, synthesize n ttker f A suh tht it genertes ontrolled lnguge L (S A /G) tht stisfies: 1. s L (S A /G), ˆf A (P(s)) is defined; 2. s L (S A /G), ˆf A (P(s)) P(L (S P /G)); 3(). s L (S A /G), s.t. ( t [P 1 (P(s)) L (G)]) δ(x 0,t) X rit. In this se, we sy tht f A is strong ttker. We dditionlly define the notion of wek ttker s follows: 3(). s L (S A /G), s.t. ( t [P 1 (P(s)) L (G)]) δ(x 0,t) X rit. In the formultion of the ove prolem, the ttker funtion needs to e well defined for ll projeted strings in the modified ontrolled lnguge P(L (S A /G)). Condition 2 gurntees the stelthy ehvior of the ttker, mening ny string in P(L (S A /G)) should e modified to string within the originl ontrolled ehvior. In this mnner, R never rehes stte ded. Lstly, ondition 3 exploits the rehility of ritil sttes, where ondition 3() is strong version of the prolem. In the strong se, the ttker is sure tht the system hs rehed ritil stte if string s ours in the system. Condition 3() is relxed version, where the ttker is not sure if ritil stte ws rehed, lthough it ould hve een rehed. Both vritions of ondition 3 gurntee the existene of t lest one suessful ttk, nmely, when string s ours in the new ontrolled ehvior. IV. ALL STEALTHY INSERTION-DELETION ATTACKS A. Definition The All Stelthy Insertion-Deletion Attk struture (IDA) is n extension of the iprtite trnsition struture presented in [16]. The IDA ptures the gme etween the environment nd supervisor onsidering the possiility tht suset of the sensor network hnnels my e ompromised y 4226

4 mliious ttker. Consequently, the IDA must e le to pture the differene etween the tul informtion from the system output nd the informtion oserved y the supervisor, where the ltter is indued y the ttker when it provides the supervisor with flse sensor events. In order to pture this differene, we define n informtion stte IS s pir IS 2 X Q, nd the set of ll informtion sttes s I = 2 X Q. The first element in IS represents the orret IS, i.e., the true informtion stte of the system, s seen y the ttker for the tul system outputs. The seond element represents the supervisor s stte, whih is the urrent stte of its reliztion sed on the edited string of events tht it reeives. Rell tht Σ is the set of ompromised events, nd we ll the events in Σ \ Σ uneditle. In order to onstrut the IDA struture, let Σ i = {e i e Σ } e the set of inserted events nd Σ d = {e d e Σ } e the set of deleted events. Note tht, Σ i nd Σ d re disjoint, nd oth re disjoint with Σ. For onveniene, we lso define Σ e = Σ i Σ d to e the set of edited events. We re using these nottions for lrity of the methodology; from the supervisor s point of view, e i = e nd e d = ε, e i Σ i nd e d Σ d. Furthermore, let us define the projetion opertion P e : Σ e Σ s P e (e i ) = P e (e d ) = e. Definition IV.2. An All Insertion-Deletion Attk struture (IDA) A w.r.t. G, Σ, nd R, is 7-tuple where, A = (Q S,Q E,h SE,h ES,Σ,Σ e,y 0 ) (5) Q S I is the set of S-sttes, where S stnds for Supervisor nd y 1 2 X nd y 2 Q denote the first nd seond element of S-stte y, respetively. Thus, y = (y 1,y 2 ); Q E I Γ is the set of E-sttes, where E stnds for Environment nd where I 1 (z), I 2 (z), nd Γ(z) denote the orret IS, the supervisor s stte, nd the ontrol deision omponents of E-stte z, respetively. Thus z = (I 1 (z),i 2 (z),γ(z)); h SE : Q S Γ Q E is the prtil trnsition funtion from S-sttes to E-sttes, stisfying the following onstrint: h SE (y,γ) := z, where [I 1 (z) = UR γ (y 1 )] [I 2 (z) = y 2 ] [Γ(z) = γ = Γ R ({y 2 }) Σ u ] (Note tht h SE is only defined for y nd γ suh tht γ = Γ R ({y 2 }) Σ u.) h ES : Q E (Σ o Σ e ) Q S is the prtil trnsition funtion from E-sttes to S-sttes, stisfying the following onstrints: for ny y Q S, z Q E nd e Σ o Σ e, we hve: (6) h ES (z,e) := y = (y 1,y 2 ) (7) [y 1 = Next e (I 1 (z)), y 2 = µ(i 2 (z),e)] [y 1 = I 1 (z), y 2 = µ(i 2 (z),p e (e))] if e Σ i nd P e (e) Σ Γ R ({I 2 (z)}) if e Γ(z) Σ o Γ G (I 1 (z)) [y 1 = Next Pe (e)(i 1 (z)), y 2 = I 2 (z)] if e Σ d nd P e (e) Γ(z) Σ Γ G (I 1 (z)) Σ is the set of events of G; Σ e is the set of edited events; y 0 Q S is the initil S-stte: y 0 := ({x 0 },q 0 ); (8) (8) (8) Sine the purpose of the IDA is to pture the gme etween the supervisor nd the environment, we use iprtite struture to represent eh entity. An S-stte is pir IS ontining the orret IS nd the supervisor s stte; it is where the supervisor issues its ontrol deision. An E-stte is pir IS nd ontrol deision, for whih the environment (system or ttker) selets one mong the oservle events to our. A trnsition from n S-stte to n E-stte represents the updted unoservle reh in the orret IS together with the urrent supervisor stte nd its ontrol deision. A trnsition from n E-stte to n S-stte represents the oservle reh immeditely following the exeution of the oservle event y the environment. In this se, oth the orret IS nd the supervisor s stte re updted. However, the updte of the orret IS nd of the supervisor s stte depends on the type of event generted y the environment: true system event unltered y the ttker, (fititious) event insertion y ttker, or deletion y ttker of n event just exeuted y the system. Thus, the trnsition rules re split into three ses, desried elow. The prtil trnsition funtion h ES is hrterized y three ses: Equtions (8),(8), nd (8). Eqution (8) is relted to system tions, while Equtions (8) nd (8) re relted to ttker tions. In the se of Eqution (8), the ttker only inserts events onsistent with the ontrol deision of the urrent supervisor stte (whih ws enhned to inlude unontrollle events). In the se of Eqution (8), it only deletes tul oservle events generted y the system. In the se of Eqution (8), the system genertes fesile (enled) event nd the ttker lets the event reh the supervisor intt, either euse it nnot ompromise tht event, or euse it hooses not to mke move. Exmple IV.2. As ontinution of Exmple II.1, let us onstrut the IDA struture for the given G nd R 1, dditionlly with Σ = {} nd X rit = {2}. Figure 4() shows the resulting struture where ovl sttes represent the S- sttes nd retngulr sttes represent the E-sttes. Moreover, red sttes indites where the supervisor rehes the ded stte, green sttes represent the suessful rehility of ritil sttes, nd rown sttes represent system dedloks (for simpliity, we do not onstrut the IDA eyond green sttes). In this exmple, the ttker is le to reh, with 4227

5 ertinty, ritil stte. However, there exists tre for whih the ttker might e disovered, due to the ourrene of unontrollle nd uneditle event tht leds to stte ded in the supervisor. Lter in this setion, we investigte the elimintion of suh tres y performing further proessing (pruning) on the IDA. As seond exmple, we onsider gin G ut with supervisor R 2 from Exmple II.1, where Σ = {} nd X rit = {2}. The IDA in Fig. 4() (prtilly onstruted due to limited spe) demonstrtes how prtilly oserved system my introdue unertinty for the ttker. In this exmple, the ttker does not know for ertin whether its ttk sueeded. The orret informtion t stte ({1, 2}, D,{, }) ontins ritil s well s non-ritil sttes, mening the system might not end up in ritil stte. We further investigte this sujet lter in this setion. i d i ({4},D) i {} {} {} {} ({3},C) d i {} i {} i d {} {} {} d d () IDA for Exmple IV.2 prt 1 {} i i i {} {} {,} {} {} () Prtilly onstruted IDA for Exmple IV.2 prt 2 Fig. 4: Results of Exmple IV.2 Given two IDAs A 1 nd A 2, we sy tht A 1 is susystem of A 2, denoted y A 1 A 2, if Q A 1 E QA 2 E, QA 1 S QA 2 S, nd for ny y Q A 1 S, z QA 1 E, γ Γ, nd e Σ, we hve tht: 1) h A 1 SE (y,γ) = z ha 2 SE (y,γ) = z nd 2) h A 1 ES (z,e) = y ha 2 ES (z,e) = y. B. Pruning Proess Exmple II.1 shows how unontrollle nd uneditle events might potentilly revel the ttker s presene to the supervisor, y tking it to its ded stte. Our ultimte ojetive is to onstrut stelthy ttk; thus we will prune the IDA to eliminte pths tht revel the presene of the ttker to the supervisor. The pruned IDA struture will only ontin stelthy ttks. The pruning proess n e formulted similrly s Bsi Supervisory Control Prolem (BSCP) s defined in [20]. However, we need to inlude n dditionl ondition to ensure the non-existene of re ondition etween the ttker nd the system. Speifilly, we do not llow the sitution where the only possile move from the ttker {} is to insert n event; i.e., it nnot e the se tht letting the event through nd ersing it re oth sent s possile moves of the ttker. Adding this extr ondition to the stndrd lgorithm for solving BSCP results in Algorithm 1. Algorithm 1 Modified BSCP Require: A = (Q E Q S,E, f se f es, 0 ), where E (Σ o Σ e Γ) nd A trim = (A t,e, f t, t 0 ), where At Q E Q S 1: Step 1 Compute H 0 = (A 0,E,g 0,( 0, t 0 )) = A A trim, where is the produt of utomt opertion nd A 0 (Q S Q E ) (Q S Q E ), nd set i = 0 2: Step 2 Clulte 3: Step 2.1 A i = {(, t ) Y i Γ A ({}) E u Γ Hi ({(, t )})} 4: Step 2.2 A i = {(, t ) Y i e Σ e Γ A ({}) (e Γ Hi ({(, t )}) e d Γ Hi ({(, t )})} g i = g i A i, trnsition funtion updte 5: Step 2.3 H i+1 = Trim(A i,e,g i,( 0, t 0 )) 6: Step 3 If H i+1 = H i, Stop; otherwise i i + 1 Remrk: The only differene etween the originl BSCP lgorithm [20] nd its modified version in Algorithm 1 is the ddition of step 2.2 in the itertion proess. Nmely, ny fesile system event must either e let through or ersed, in ddition to possile insertions y the ttker. Tht is, sttes where oth the let through trnsition nd the ersure trnsition re sent for fesile system event will e deleted, s suh sitution mens tht the ttker is fored to re to do insertions efore the system exeutes tht event. Thus, to ompute stelthy IDA we define s system the IDA onstruted ording to Definition IV.2. Moreover, ny event in e Σ Σ e is treted s ontrollle while events e Σ o \Σ nd γ Γ re treted s unontrollle. The speifition lnguge is otined y deleting the sttes where the supervisor rehes the ded stte, i.e., y deleting in IDA ll sttes of the form y = (S, ded) for ny S X. We re le to onsider ll events in Σ s ontrollle sine from the ttker s point of view, it ould hoose to prevent updtes of the supervisor s stte y ersing suh events. In other words, the ttker is not disling ny fesile unontrollle event in G, ut rther it is suppressing the informtion given to the supervisor. Let us now formlize the pruning proess for otining ll stelthy insertion-deletion ttks s follows. Definition IV.3. Given the IDA A onstruted ording to Definition IV.2, define the system utomton A G = A with Σ A = Σ Σ e s the set of ontrollle events nd Σ A u = (Σ o \Σ ) {γ γ Γ} s the set of unontrollle events. The speifition utomton is defined y A trim, whih is otined y trimming from A G ll its sttes of the form (S, ded), for ny S X. The Stelthy IDA struture, denoted y A S, is defined to e the utomton otined fter running Algorithm 1 on A trim w.r.t. A G nd Σ. Lemm IV.1. If f A stisfies onditions (1) nd (2) of Prolem III.1, then f A n e synthesized from A S. 4228

6 Proof. We do sketh of the proof. Given n ttker funtion f A tht stisfies onditions 1 nd 2 from Prolem III.1, it must e inluded in A S, euse A S is onstruted sed on the IDA A from definition IV.2. The onstrution of A exhusts ll possile fesile trnsitions in eh E-stte, therefore it is the mximl struture. When we uild A S, the only sttes deleted re those tht led the supervisor to its ded stte. The deletion proess does not remove ny pth tht stisfies onditions 1 nd 2. Therefore, ll pths of f A must exist in A S, whih mens tht f A n e synthesized from A S. Lemm IV.2. If n ttker funtion f A is synthesized from A S, then onditions (1) nd (2) from Prolem III.1 re stisfied. Proof. We do sketh of the proof. Given n ttker funtion f A synthesized from the A S, we wnt to prove the lemm y ontrdition. Thus, ssume tht f A violtes ondition 1 or ondition 2. First, let us ssume only ondition 2 is violted. If ondition 2 is violted, there must exist string s L (G) s.t. S A (P(s)) = ded. But, y onstrution, A S does not ontin ny S-stte y = (y 1,ded). Condition 1 on the other hnd is never violted given tht the onstrution of A S speifies t eh E-stte ll fesile trnsitions of the system S A /G. Therefore, f A must stisfy onditions 1 nd 2 from Prolem III.1. Lemm IV.3. The All Stelthy IDA A S hs ll possile stelthy insertion-deletion ttks with respet to Σ, R nd G. Proof. The proof follows from Lemms IV.1 nd IV.2. Exmple IV.3. Let us ontinue Exmple IV.2 nd onstrut the IDA A S for the IDA A shown in Fig. 4(). We otin the speifition to e used for Alg. 1 opertion y deleting the red sttes in Fig. 4(). The result of the Algorithm 1 is shown in Fig. 4(), where sttes mrked with red ross were deleted. In essene, the result sys tht in order to remin stelthy, the ttker should not insert event when it knows tht the system is in stte 0 nd the supervisor is in stte A. Note tht, stte ({2},A,{}) is not deleted y Alg. 1, thus we n find suessful ttk strtegy. One ttk strtegy is to insert event when the system is in stte 1 nd the supervisor is in stte B, otherwise it lets the events reh the supervisor intt. C. Anlysis The stelthy IDA struture A S emeds ll possile insertion-deletion tions tht n ttker my perform while remining unnotied y the supervisor. Nevertheless, it is possile tht none of these tions performed y the ttker will result in the system rehing ritil stte. In this susetion, we provide some remrks out the stelthy IDA struture, long with the min theorem tht ddresses our synthesis Prolem III.1. First, let us provide theorem sed on the A S struture. Theorem IV.1. If the stelthy IDA struture A S stisfies A S A /0, where A /0 is the IDA struture given Σ = /0, then there does not exist ny f A w.r.t. Σ tht solves Prolem III.1. Proof. The result follows from Lemm IV.3 nd tht the ttker nnot perform ny tion. Theorem IV.1 only provides neessry ondition for the existene of suessful stelthy insertion-deletion ttk. Thus, even if the A S is stritly igger system thn A /0, there is no gurntee of existene of suessful ttk. Before we introdue the min theorem, let us dd remrks out stte properties relted with A S. Orthogonl to the strong versus wek distintion in Prolem III.1, ttks n lso e lssified long different xis: ritil nd dedlok ttks. When the ttker suessfully indues the system into rehing ritil unsfe stte, we ll this ritil ttk. Alterntively, the ttker my ttempt to indue the system into entering dedlok; this is lled dedlok ttk. Formlly: Definition IV.4. Strong ritil ttks re defined to e the set of tions performed y the ttker suh tht A S rehes E-stte z Q E s.t. x I 1 (z), x X rit. Similrly, wek ritil ttks re defined to e the set of tions performed y the ttker suh tht A S rehes n E-stte z Q E s.t. x I 1 (z), x X rit. Definition IV.5. Strong dedlok ttks re defined to e the set of tions performed y the ttker suh tht A S rehes E-stte z Q E s.t. e Γ(z), Next e (I 1 (z)) = /0. Similrly, wek dedlok ttks re defined to e the set of tions performed y the ttker suh tht A S rehes n E-stte z Q E s.t. x I 1 (z) nd e Γ(z), Next e ({x}) = /0. Lstly, we sy n ttk is unsuessful if it results in neither dedlok nor ritil stte. Theorem IV.2. Given the system G, the supervisor R, nd Σ, there exists f A tht strongly stisfies Prolem III.1 if nd only if there exists strong ritil ttk in the A S struture. On the other hnd, it wekly stisfies Prolem III.1 if nd only if there exists wek ritil ttk in the A S struture nd there does not exist strong ritil ttk. Proof. The proof follows from Lemm IV.3. Remrk In Definition IV.5, dedlok ttks re introdued. An ttker ould lso identify dedloks s hrmful, with tht in mind Prolem III.1 ould e extended to pture dedloks s gols for the ttker. Clerly, Theorem IV.2 ould e extended to tht new prolem. D. Complexity Anlysis Given G with X sttes, the urrent stte estimtor hs t most X S = 2 X. To uild the IDA, s ws mentioned efore, it is neessry to mintin informtion of the stte estimtor of G s well s the urrent stte of supervisor R. Therefore the IDA struture hs the size X S Q in the worst se. In ll, the spe omplexity of the IDA is O( X S Q ). 4229

7 V. CASE STUDY: WATER TREATMENT PLANT The Seure Wter Tretment (SWT) system 1 is tested loted t the Singpore University of Tehnology nd Design (SUTD). The system is fully funtionl, sleddown version of n industril plnt, nd it performs ll of the ritil opertions tht re involved in stndrd wter tretment proess. The system is ssoited with numer of sfety requirements tht it must stisfy, e.g., it must lwys mintin the level of wter in its tnk elow ertin threshold. In this se study, we onstruted model of SWT, nd used verifition tool sed on first-order onstrint solver to utomtilly generte stelthy ttks on the model using the frmework presented in this work. The output of our synthesis pproh desries relisti ttks tht were suessfully demonstrted on SWT in prior work [18], whih does not provide generl formultion of stelthy ttks s we hve done in this pper. Using our model, we generted severl potentil ttks tht my use the wter tnk to overflow. Detils of the SWT se study were omitted due to limited spe, ut n e found in [22]. VI. CONCLUSION We hve onsidered the prolem of disovering stelthy deeption ttks tht use physil dmge in CPS. We define the ttker s n edit funtion tht rets to the plnt s outputs nd trnsforms them in wy tht gurntees stelthiness. The IDA struture ws introdued to pture the gme etween the environment (i.e., system nd ttker) nd the given supervisor. The IDA emeds ll vlid tions of the ttker. Bsed on the IDA, n lgorithm ws provided to synthesize stelthy IDA tht emeds ll stelthy tions of n ttker. Given the stelthy IDA, we showed how to verify if there exists n edit funtion tht leds the system to unsfe ritil sttes without detetion of the ttk. In ontrst to relted work, we do not mke ny ssumptions out the prtitions of oservle nd ontrollle events of the system. We lso desried se study vlidting our pproh on relisti exmple. In the future, we pln to investigte how to modify supervisor tht is suseptile to stelthy deeption ttks. We lso pln to tkle the prolem of designing diretly supervisors tht enfore sfety nd liveness speifitions nd t the sme time re roust to deeption ttks. VII. ACKNOWLEDGEMENTS The uthors grtefully knowledge the ontriutions of Xing Yin nd Christoforos Keroglou in reviewing the pper nd providing insightful omments. We would lso like to thnk Sridhr Adepu nd Adity P. Mthur t the Singpore University of Tehnology nd Design for their help with the se study on the wter tretment system. Finlly, we thnk n nonymous reviewer for pointing out the need to dd step 2.2 in Algorithm REFERENCES [1] A. A. Crdens, S. Amin, nd S. Sstry, Seure ontrol: Towrds survivle yer-physil systems, in 2008 The 28th Interntionl Conferene on Distriuted Computing Systems Workshops, June 2008, pp [2] A. Teixeir, D. Pérez, H. Snderg, nd K. H. Johnsson, Attk models nd senrios for networked ontrol systems, in Proeedings of the 1st Interntionl Conferene on High Confidene Networked Systems, ser. HiCoNS 12. New York, NY, USA: ACM, 2012, pp [3] D. Thorsley nd D. Teneketzis, Intrusion detetion in ontrolled disrete event systems, in Proeedings of the 45th IEEE Conferene on Deision nd Control, De 2006, pp [4] A. Poli, M. Srtini, nd S. Lfortune, Ative fult tolernt ontrol of disrete event systems using online dignostis, Automti, vol. 47, no. 4, pp , Apr [5] L. K. Crvlho, Y. C. Wu, R. Kwong, nd S. Lfortune, Detetion nd prevention of tutor enlement ttks in supervisory ontrol systems, in 13th Interntionl Workshop on Disrete Event Systems (WODES), My 2016, pp [6] M. Wkiki, P. Tud, nd J. P. Hespnh, Supervisory ontrol of disrete-event systems under ttks, CoRR, vol. s/ , [Online]. Aville: [7] R. Su, Supervisor synthesis to thwrt yer ttk with ounded sensor reding ltertions, CoRR, vol. s/ , [Online]. Aville: [8] K. Rohloff, Bounded sensor filure tolernt supervisory ontrol, IFAC Proeedings Volumes, vol. 45, no. 29, pp , [9] F. Lin, Control of networked disrete event systems: Deling with ommunition delys nd losses, SIAM Journl on Control nd Optimiztion, vol. 52, no. 2, pp , [10] M. V. S. Alves, J. C. Bsilio, A. E. C. d Cunh, L. K. Crvlho, nd M. V. Moreir, Roust supervisory ontrol ginst intermittent loss of oservtions, IFAC Proeedings Volumes, vol. 47, no. 2, pp , [11] X. Yin, Supervisor synthesis for mely utomt with output funtions: A model trnsformtion pproh, IEEE Trnstions on Automti Control, vol. PP, no. 99, [12] A. Soori nd C. N. Hdjiostis, Notions of seurity nd opity in disrete event systems, in 46th IEEE Conferene on Deision nd Control, De 2007, pp [13] F. Lin, Opity of disrete event systems nd its pplitions, Automti, vol. 47, no. 3, pp , Mr [14] F. Cssez, J. Dureil, nd H. Mrhnd, Synthesis of opque systems with stti nd dynmi msks, Forml Methods in System Design, vol. 40, no. 1, pp , [15] Y.-C. Wu, V. Rmn, B. C. Rwlings, S. Lfortune, nd S. A. Seshi, Synthesis of ofustion poliies to ensure privy nd utility, Journl of Automted Resoning, Jul [Online]. Aville: [16] X. Yin nd S. Lfortune, A uniform pproh for synthesizing property-enforing supervisors for prtilly-oserved disrete-event systems, IEEE Trnstions on Automti Control, vol. 61, no. 8, pp , Aug [17], Synthesis of mximlly-permissive supervisors for the rnge ontrol prolem, IEEE Trnstions on Automti Control, vol. PP, no. 99, pp. 1 1, De [18] E. Kng, S. Adepu, D. Jkson, nd A. P. Mthur, Model-sed seurity nlysis of wter tretment system, in Proeedings of the 2nd Interntionl Workshop on Softwre Engineering for Smrt Cyer- Physil Systems, SEsCPS@ICSE 2016, Austin, Texs, USA, My 14-22, 2016, 2016, pp [19] P. J. Rmdge nd W. M. Wonhm, Supervisory ontrol of lss of disrete event proesses, SIAM J. Control Optim., vol. 25, no. 1, pp , Jn [20] C. G. Cssndrs nd S. Lfortune, Introdution to Disrete Event Systems. Seuus, NJ, USA: Springer-Verlg New York, In., [21] A. Poli nd S. Lfortune, Sfe dignosility for fult-tolernt supervision of disrete-event systems, Automti, vol. 41, no. 8, pp , Aug [22] R. M. Goes, R. Kwong, E. Kng, nd S. Lfortune, Stelthy deeption ttks for yer-physil systems, Deprtment of Eletril Engineering nd Computer Siene, Ann Aror, Mihign, Teh. Rep., August