Is this a good time?: deciding when to launch attacks on process control systems

Abstract

We introduce a new problem formulation for understanding the threats and vulnerabilities of process control systems. In particular, we consider an adversary that has compromised sensor or actuator signals of a control system and needs to identify the best time to launch an attack. We have previously shown that attackers might not be able to reach if the timing of their Denial-of-Service (DoS) attacks is not chosen strategically: Therefore, if the timing of a DoS attack is not chosen correctly, the attack can have limited impact; however, if the timing of the attack is chosen carefully, the attack has higher chances of succeeding. We formulate the problem of selecting a good time to launch DoS attacks as an optimal stopping problem that the adversary has to solve in real-time. In particular, we use the theory for the Best-Choice Problem to identify an optimal stopping criteria and then use a low pass filter to identify when the time series of a process variable has reached its peak. We identify some of the complexities associated with solving the problem and outline directions for future work.