Supervisory Control of Discrete-Event Systems Under Attacks

Abstract

We consider a multi-adversary version of the supervisory control problem for discrete-event systems, in which an adversary corrupts the observations available to the supervisor. The supervisor's goal is to enforce a specific language in spite of the opponent's actions and without knowing which adversary it is playing against. This problem is motivated by applications to computer security in which a cyber defense system must make decisions based on reports from sensors that may have been tampered with by an attacker. We start by showing that the problem has a solution if and only if the desired language is controllable (in the Discrete event system classical sense) and observable in a (novel) sense that takes the adversaries into account. For the particular case of attacks that insert symbols into or remove symbols from the sequence of sensor outputs, we show that testing the existence of a supervisor and building the supervisor can be done using tools developed for the classical DES supervisory control problem, by considering a family of automata with modified output maps, but without expanding the size of the state space and without incurring on exponential complexity on the number of attacks considered.Discrete event systems (DESs) are non-deterministic transition systems defined over a typically finite statespace. The DESs supervisory control problem refers to the design of a feedback controller -called a supervisor -that restricts the set of possible sequences of transitions (typically represented by strings over an alphabet of transitions) to a desired set K. The supervisor's task is complicated by the fact that (i) only a subset of transitions can be inhibited (the so called "controllable" transitions) and (ii) the supervisor only has partial information about the state of the system, which it gathers by observing a string of "output symbols." This basic problem is motivated by a wide range of applications that include manufacturing systems, chemical batch plants, power grids, transportation systems, database management, communication protocols, logistics, and computer security. The latter is the key motivating application for the work reported here.

Supervisor Obfuscation Against Actuator Enablement Attack

“…Recently, cyber-physical systems have drawn a lot of attention from the supervisory control and formal methods research communities (see, for example, [1], [2], [3], [4], [5], [6], [7]). The supervisory control theory of discrete-event systems 1 [18] has been proposed as a general approach for the synthesis of correct-by-construction supervisors that ensure both safety and progress properties on the closed-loop systems.…”

Towards Bounded Synthesis of Resilient Supervisors

“…For each σ ∈ Σ c,A ∩ Σ uo , we know that ζ T (x i , σ ) = x i in S T for each i ∈ [0, n − 1]. This is captured in Constraints (7). Constraints (8) intuitively mean that there cannot be transitions labeled by σ / ∈ Σ c,A ∩Σ o from x i to x n , for each i ∈ [0, n − 1].…”

“…Constraints (8) intuitively mean that there cannot be transitions labeled by σ / ∈ Σ c,A ∩Σ o from x i to x n , for each i ∈ [0, n − 1]. Constraints (7) are (8) ensure that S T is a (properly) transformed supervisor. Then, let φ S T ,con obs n denote the resultant formula after combining Constraints (5), (6), (7) and (8).…”

“…Constraints (7) are (8) ensure that S T is a (properly) transformed supervisor. Then, let φ S T ,con obs n denote the resultant formula after combining Constraints (5), (6), (7) and (8).…”

“…The safety of cyber-physical systems (CPS) against adversarial attacks has recently drawn much research interest from both the discrete-event systems and formal methods community [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12]. For a recent survey and position paper on the discrete-event systems based approach, the reader is referred to [13].…”