Monitor-Based Supervisory Control of Labeled Petri Nets Under Sensor Attacks

In this paper we investigate a supervisory control problem of discrete event systems under attacks. Specially, we consider a type of sensor deception attacks, called replacement attacks, under which the intruder confuses the observation of events by substituting the occurrence of an observation with another. We use labeled Petri nets as the reference formalism to model a discrete event system and represent control specifications in terms of generalized mutual exclusion constraints (GMECs). The concept of a monitor function is proposed to describe the satisfiability of GMECs given an observation by counting the number of occurrences of each label. Due to the existence of attacks, some labels generated by a plant are prone to be altered by an attacker, interfering with a supervisor such that it cannot make correct control decisions. For assisting the monitor function to estimate the number of occurrences of those altered-prone labels, generated by the plant, the notion of label dependency is introduced. Accordingly, a monitor-based supervisor is designed with low online computational effort, avoiding the marking estimation or the reachability analysis of the system. It is verified that the proposed supervisor not only enforces all GMECs no matter whether or not replacement attacks occur, but also keeps the system's behavior as permissive as possible. Note to Practitioners—Cyber physical systems (CPSs) have exhibited multifaceted applications in various fields such as process control systems, smart grids, distributed robotics, autonomous vehicles. Due to the over-reliance on communication networks, CPSs are vulnerable to attacks that can tamper the data collection processes and interfere safety critical decision making processes, resulting in catastrophic damages to the systems. In the frame of discrete event systems, most of existing supervisory control strategies of CPSs under attacks rely on an exhaustive reachability analysis, which is computationally expensive, making such approaches hardly applicable to large systems. In order to address this issue, this work considers a type of sensor deception attacks, called replacement attacks, and proposes a monitor-based supervisor policy, enforcing the control specifications of the systems in the presence of replacement attacks. Without requiring tedious analysis, the designed online supervisor has low computational effort and control decisions only depend on a direct analysis of the observation sequence.