Opacity Evaluation Of Discrete Event Systems Under Attacks Using Game Theory

For a discrete event system,given a set of secret states,the system is said to be opaque if an intruder cannot infer whether a current state of the system belongs to the secret set.Methods such as insertion functions are usually introduced to enhance the opacity of systems,which are mainly manifested as the recoding of an output sequence.In addition,in discrete event systems such as cyber or cyber-physical systems,there are many events that cannot be observed,which makes it impossible for an intruder to infer the current state of the system.It is significant for the intruder to find a method to solve this problem.We summarize the physical reasons for the opacity of a system and take the position of the intruder to attack the physical layer of the system to weaken the opacity.In labeled Petri nets,if the firing of an unobservable transition can be inferred by observing an observable transition,we say that the former is colored by the latter.Based on this fact,an intrusion mechanism is designed to infer the system state.The system state is inferred by eliminating the influence of unobservable events.We assume that an external protection mechanism is designed to resist the influence of an invasion through paying some cost.A sensor is designed for the protection mechanism such that it can sense unobservable transitions being colored by an intruder and send the incorrect information of the states to confuse the intruder.In a labeled Petri net,the intrusion and the protection are shown as transition coupling and place coupling in physical structure,respectively.Then a framework is developed for the intruder versus the system.The notions of static criterion and dynamic criterion are proposed to analyze the degree of a system's opacity.The static criterion refers to the inherent opacity of the system given by its physical structure,which is formulated by analyzing unobservable transitions and secret states set.The larger the criterion value,the more opaque the system.An attack strategy is provided for the intruder to make the static criterion drop to zero in the fastest way.According to the framework of the intruder versus the system,a game between the intruder and the system is built.The dynamic criterion is decided by the result of the game.A reasonable intruder that is willing to pay more cost can predict the protection behavior of the system and launch a new attack.The system is also reasonable,which may stubbornly resist.Therefore,the attack and protection behaviors will continue.The cost consists of two parts:(1)the cost to design the attack and protection mechanisms;and(2)the rounds of taking part in attack and resistance.The decisive factor affecting the outcome of the game is the cost,i.e.,the one who pays higher cost wins.The intruder can make an optimal action if it can predict the system's cost.In this work,we are in the position of the intruder to calculate the Kullback-Leibler divergence between the actual and the predicted distribution of the system cost to optimize the predicted distribution.Two strategy models are given for the intruder to attack the system:(1)the intruder with the highest cost obtains the maximum probability of winning the game;(2)the smaller the Kullback-Leibler divergence is,the more accurate the predicted distribution is obtained.Two strategy models are validated by examples.The probability of the intruder winning the game is taken as the dynamic evaluation criterion of the system's opacity faced with the intruder.It is shown that the bigger the probability is,the less opacity the system has.