Searcharxiv⌕ Search
Home/Archive/arXiv

arXiv · 1911.12757

Modelling Load-Changing Attacks in Cyber-Physical Systems

Luca Arnaboldi·Ricardo M. Czekster·Roberto Metere·Charles Morisset
View original source ↗Read source document ↗Export metadata ↓

Abstract

Cyber-Physical Systems (CPS) are present in many settings addressing a myriad of purposes. Examples are Internet-of-Things (IoT) or sensing software embedded in appliances or even specialised meters that measure and respond to electricity demands in smart grids. Due to their pervasive nature, they are usually chosen as recipients for larger scope cyber-security attacks. Those promote system-wide disruptions and are directed towards one key aspect such as confidentiality, integrity, availability or a combination of those characteristics. Our paper focuses on a particular and distressing attack where coordinated malware infected IoT units are maliciously employed to synchronously turn on or off high-wattage appliances, affecting the grid's primary control management. Our model could be extended to larger (smart) grids, Active Buildings as well as similar infrastructures. Our approach models Coordinated Load-Changing Attacks (CLCA) also referred as GridLock or BlackIoT, against a theoretical power grid, containing various types of power plants. It employs Continuous-Time Markov Chains where elements such as Power Plants and Botnets are modelled under normal or attack situations to evaluate the effect of CLCA in power reliant infrastructures. We showcase our modelling approach in the scenario of a power supplier (e.g. power plant) being targeted by a botnet. We demonstrate how our modelling approach can quantify the impact of a botnet attack and be abstracted for any CPS system involving power load management in a smart grid. Our results show that by prioritising the type of power-plants, the impact of the attack may change: in particular, we find the most impacting attack times and show how different strategies impact their success. We also find the best power generator to use depending on the current demand and strength of attack.

Explore related subjects

eess.SYcs.CRcs.SY

Keep this discovery

BibTeXRIS

Luca Arnaboldi, Ricardo M. Czekster, Roberto Metere, Charles Morisset. 2019-11-28. Modelling Load-Changing Attacks in Cyber-Physical Systems. https://arxiv.org/abs/1911.12757

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Structured Stochastic Representations of Integrated Dynamic Strategies

Dynamic allocation decisions couple present resource use to evolving internal conditions, delayed returns, and future costs. We represent this interaction by four probability localizations linked through regime-indexed, graph-constrained column-stochastic operators. Pre-action state or context selects a locally affine model, while action-dependent changes update subsequent regimes, yielding a causal switched representation of nonlinear evolution. We characterize operator identifiability relative to the graph, the stochastic constraints, and the sampled embedding, separating coefficient recovery from predictive equivalence on the decision domain. Decision making is then formulated through implementable return--cost acceptability regions. Finite-horizon error propagation supplies conservative classification margins, and simultaneous intervals distinguish model-relative near-optimality from certified $\epsilon$-optimality over a declared finite policy class. Regime-indexed stochastic feedback is admitted when it satisfies the same certification test. Reproducible synthetic laboratories for personal preparation, supplier participation, and customer retention illustrate exact, operator-supplied, and noisy feedback cases. Multinomial experiments show improving recovery of the feedback function and fewer unresolved decisions with increasing sample size, while unrestricted off-policy recovery remains limited. The contribution is a structure-preserving representation--identification--decision workflow, not a domain-specific physiological or commercial calibration.

eess.SY↗
arXiv2026

Fusion Estimation in Multi-sensor Systems for Data Packets with Disrupted Identities

In this paper, we explore the problem of fusion estimation for a multi-sensor system where the identity of the data packet received by each sensor may be disrupted or incorrect due to confusion in device identity allocation, communication protocol defects, or the lack of a clear sensor identifier. This can result in a random shuffle of the data components during the fusion estimation process, compromising the performance of the fusion estimation. To address this issue, we introduce the concepts of permutations and symmetry groups to describe this phenomenon as data packet permutation. We construct statistics to simplify the information set, developing two algorithms: a Bayesian approach, which performs fusion using posterior arrangement probabilities, and a greedy approach, which effectively improves estimation performance by guessing the likely data arrangement. We compare these two algorithms and demonstrate that both are expectation error-bounded. We improve algorithms for information-scarce scenarios. By employing the expectation-maximization algorithm, we fill in the prior information of data arrangement where the correct convergence is proven. Finally, we present numerical simulations to validate our results.

eess.SY↗
arXiv2026

Quantifying the Reality Gap for RL-Based UAV Placement at mmWave and Sub-THz

Reinforcement learning (RL) policies for unmanned aerial vehicle (UAV) placement in mmWave and sub-terahertz networks are typically trained on simplified analytical channels. We quantify the resulting sim-to-real gap on a real urban map of Doha, Qatar, at carriers {28, 140, 183, 300} GHz and altitudes {50, 75, 100, 125} m, evaluating three channel pipelines: an analytical model (FSPL + atmospheric absorption + cuboid LoS), full Monte-Carlo ray tracing in Sionna RT with ITU-R P.676-13 absorption, and a deterministic-LoS hybrid that reuses Sionna's mesh under a closed-form path-gain expression. We formalize the gap on the spatial SNR distribution via four metrics, namely bias, RMSE, Jensen-Shannon divergence, and optimum-deployment displacement. Three findings emerge: at 28/140 GHz, $\sim$70% of the apparent -5.6/-4.8 dB Sionna bias is Monte-Carlo undersampling and shrinks to -1.7/-1.5 dB after mitigation; at 183 GHz a -9.2 dB residual isolates the atmospheric absorption / ITU-R P.676 line-shape disagreement; at 300 GHz the stochastic ray tracer agrees with the analytical model only coincidentally, with a +3.8 dB structural offset exposed by the deterministic-LoS pipeline. Across all carriers the linear-domain regret of the analytical-trained policy stays $\geq$ 0.93, indicating practical near-optimality but with a carrier-resolved SNR bias that warrants explicit reporting.

eess.SY↗