Reachability Requirements Research Articles

Reactive Symbolic Planning and Control in Dynamic Adversarial Environments

Satisfying both safety and reachability requirements in dynamic adversarial environments is very challenging, particularly when little or no information about the dynamics and intentions of the adversarial objects is available. Therefore, this paper addresses the problem of path planning and control of autonomous vehicles in a dynamic adversarial reach-avoid scenario with two non-cooperative vehicles and their competitive objectives: &#x201C;reaching a target and avoiding the other vehicle&#x201D; for one of them, called attacker, and &#x201C;protecting the target and capturing the opponent vehicle&#x201D; for the other one, called defender. In the proposed solution, first, a discrete version of the problem is formulated and solved using Linear Temporal Logic, temporal games, and <inline-formula><tex-math notation="LaTeX">$\mu$</tex-math></inline-formula>-calculus to construct winning discrete strategies that guarantee safety and reachability. A comprehensive discussion on the existence, correctness, and complexity analysis of the solution is also provided. Finally, a novel correct-by-design hybrid controller is designed to generate smooth control signals that preserve the satisfaction of safety and reachability.

Reachability-Based False Data Injection Attacks and Defence Mechanisms for Cyberpower System

With the push for higher efficiency and reliability, an increasing number of intelligent electronic devices (IEDs) and associated information and communication technology (ICT) are integrated into the Internet of Things (IoT)-enabled smart grid. These advanced technologies and IEDs also bring potential vulnerabilities to the intelligent cyber–physical smart grid. State estimation, as a primary step of system monitoring and situational awareness, is a potential target for attackers. A number of other smart grid applications, such as voltage stability assessment and contingency screening, utilize state estimation results as input data. False data injection (FDI) is a specific way to attack state estimation by manipulating input data. Existing research mainly focuses on the mathematical analysis of FDI attacks; however, in these methods, discussions of reachability requirements to compromise measurements considering cyberinfrastructure are limited. Reachability is defined as a measure that estimates the number of hosts to compromise for the possible FDI. Most of the existing FDI attack methods require the simultaneous manipulation on multiple measurement devices in different substations, in order to bypass the bad data detection, which may be impractical. In this paper, a new type of reachability-based FDI attack considering the cybernetwork with a practical attack is proposed and validated on two IEEE test systems. The corresponding defence mechanisms are (a) decentralized state estimation (DSE), (b) DSE with additional backup computational nodes, (c) communication network rerouting, and (d) intrusion detection system, and they were developed and presented with validation for two IEEE test systems with superior performance for an IoT-enabled intelligent smart grid system.

Conceptualization and cases of study on cyber operations against the sustainability of the tactical edge

The last decade consolidated the cyberspace as fifth domain of military operations, which extends its preliminarily intelligence and information exchange purposes towards enabling complex offensive and defensive operations supported/supportively of parallel kinetic domain actuations. Although there is a plethora of well documented cases on strategic and operational interventions of cyber commands, the cyber tactical military edge is still a challenge, where cyber fires barely integrate to the traditional joint targeting cycle due to, among others, long planning/development times, asymmetric effects, strict target reachability requirements, or the fast propagation of collateral damage; the latter rapidly deriving on hybrid impacts (political, economic, social, etc.) and evidencing significant socio-technical gaps. In this context, it is expected that Tactical Clouds disruptively facilitate cyber operations at the edge while exposing the rest of the digital assets of the operation to them. On these grounds, the main purpose of the conducted research is to review and in depth analyze the risks and opportunities of jeopardizing the sustainability of the military Tactical Clouds at their cyber edge. Along with a 1) comprehensively formulation of the researched problematic, the study 2) formalizes the Tactical Denial of Sustainability (TDoS) concept; 3) introduces the phasing, potential attack surfaces, terrains and impact of TDoS attacks; 4) emphasizes the related human and socio-technical aspects; 5) analyzes the threats/opportunities inherent to their impact on the cloud energy efficiency; 6) reviews their implications at the military cyber thinking for tactical operations; 7) illustrates five extensive CONOPS that facilitate the understanding of the TDoS concept; and given the high novelty of the discussed topics, this paper 8) paves the way for further research and development actions.

Formal controller synthesis from specifications given by discrete-time hybrid automata

This paper deals with formal controller synthesis for discrete-time dynamical systems. We consider a specification provided under the form of a discrete-time hybrid automaton with external inputs, which can represent, for instance, instructions or informations received from a human user or from another system. The hybrid automaton describes the intended behavior of the system and we first consider the problem of synthesizing a controller such that the maximal trajectories of the closed-loop system are also maximal trajectories of the hybrid automaton. We show that the existence of an alternating simulation relation from the specification to the open-loop system is a necessary and sufficient condition for the existence of such controllers. To be able to solve this problem using symbolic (i.e. finite-state) abstractions, we provide a method to compute a symbolic specification that under-approximates the behavior of the hybrid automata. Then, we extend our approach to consider additional safety or reachability requirements so that some unsafe (e.g. blocking) states are avoided or some target states are reached, respectively. The originality of the problem is that these additional requirements are not formulated over the states of the system but over the states of the specification. Finally, we demonstrate the effectiveness of our approach with two illustrative examples from autonomous vehicle control.

Supervisory Control of Labeled Transition Systems Subject to Multiple Reachability Requirements via Symbolic Model Checking

We present an algorithm to compute the unique maximally permissive state-based supervisor for any deterministic finite labeled transition system subject to a specification with combined invariance and reachability requirements. The specifications that we consider are expressed in computation tree logic and include specifications with multiple reachability requirements, each of which should always be satisfied. The form of the controller (a state-based supervisor) is purely memoryless, so the control decisions can be made by directly sampling the state of the system that is being controlled, without recording any past event or transition history. The algorithm has been implemented in SynthSMV, an extension of the well-known model-checking solver NuSMV, which uses NuSMV's efficient implementation of symbolic model checking (based on binary decision diagrams). A case study that involves coordinating the operation of a set of reactors in a chemical plant shows how the methods that we develop apply in practice.

Application of formal verification and falsification to large-scale chemical plant automation systems

In this paper, we apply formal verification and falsification of temporal logic specifications to analyze chemical plant automation systems. We present new results, obtained by applying a recently-developed approach to handle combined invariance and reachability requirements. In addition, we develop a set of tests that can be generated automatically for a given control system, some of which have the same form as those in the existing literature, and some of which combine invariance and reachability, to which we apply the new approach mentioned previously. In both cases, we work with abstractions of the automation systems in order to apply symbolic model checking to industrial-scale problems. We demonstrate the results using a series of small illustrative examples, and also report results from an industrial case study. The methods that we apply are implemented in a pair of open-source software tools, which we describe briefly.

ROI-Driven Cyber Risk Mitigation Using Host Compliance and Network Configuration

Automated cyber security configuration synthesis is the holy grail of cyber risk management. The effectiveness of cyber security is highly dependent on the appropriate configuration hardening of heterogeneous, yet interdependent, network security devices, such as firewalls, intrusion detection systems, IPSec gateways, and proxies, to minimize cyber risk. However, determining cost-effective security configuration for risk mitigation is a complex decision-making process because it requires considering many different factors including end-hosts’ security weaknesses based on compliance checking, threat exposure due to network connectivity, potential impact/damage, service reachability requirements according to business polices, acceptable usability due to security hardness, and budgetary constraints. Although many automated techniques and tools have been proposed to scan end-host vulnerabilities and verify the policy compliance, existing approaches lack metrics and analytics to identify fine-grained network access control based on comprehensive risk analysis using both the hosts’ compliance reports and network connectivity. In this paper, we present new metrics and a formal framework for automatically assessing the global enterprise risk and determining the most cost-effective security configuration for risk mitigation considering both the end-host security compliance and network connectivity. Our proposed metrics measure the global enterprise risk based on the end-host vulnerabilities and configuration weaknesses, collected through compliance scanning reports, their inter-dependencies, and network reachability. We then use these metrics to automatically generate a set of host-based vulnerability fixes and network access control decisions that mitigates the global network risk to satisfy the desired Return on Investment of cyber security. We solve the problem of cyber risk mitigation based on advanced formal methods using Satisfiability Module Theories, which has shown scalability with large-size networks.

Falsification of combined invariance and reachability specifications in hybrid control systems

We propose an abstraction-based method that can be applied to falsify a class of computation tree logic (CTL) specifications that combine invariance and reachability requirements in terms of the discrete state of a hybrid control system. The fragment of CTL that we address is not expressible in ACTLź (which includes LTL). The method involves applying supervisory control to a finite abstraction of the hybrid system to falsify the specification. For the class of systems that we consider, falsification of the specification implies a flaw in the design of the control and automation logic.

Supervisor Synthesis to Satisfy Safety and Reachability Requirements in Chemical Process Control

A specification expressed in computation tree logic (CTL) that enforces safety and reachability requirements in discrete event systems is proposed. It is shown that the specification has a unique minimal control strategy that maximizes the set of states that satisfy the specification, and an algorithm is provided to calculate the control strategy. The specification captures the idea that the chemical process should always be able to shut down in a safe manner. The algorithm uses established CTL model checking procedures to perform the intermediate calculations, and can incorporate symbolic model checking. The maximum problem size for which a control strategy can be calculated is similar to that of the corresponding verification problem. A small example demonstrates the application of the algorithm to a problem that includes safety and reachability constraints. Current work aims to use the techniques to solve a real process control problem supplied by industry.