\section{Introduction}
The introduction of advanced sensing and communication capabilities to control systems gives rise to vulnerabilities that can be exploited with a malicious intent by an attacker (\cite{SCADA}). While the security challenges that control systems face are multifaceted and of diverse nature, the simplicity of implementation of Denial of Service (DoS) attacks in field zones and control zones makes them particularly suitable to exploit software and hardware faults. In this paper we study DoS attacks over control systems that experience packet losses over an actuator communication channel.

To account for packet loss, we consider the two protocols proposed in \cite{1}. The first one in which the packet loss is not monitored, termed UDP-like for its similarity to the communication protocol. The second protocol is termed as TCP-like and monitors the packet loss realisation by sending a packet receipt acknowledgement message back to the receiver. Both protocols and the systems they constitute are depicted in Fig. \ref{fig1} and Fig. \ref{fig2}. 
In the literature these are termed {\it like} due to previous transmissions being monitored and not retransmitted~(\cite{1}),~(\cite{4}),~(\cite{7}),~(\cite{8}). In \cite{paper1} the authors consider a deterministic DoS attack strategy on a system with power constraints whereas we consider a random DoS attack construction that operates within a no-detection region using an MPC formulation. We first study attack sequences that are constructed as an independent and identically distributed (IID) process. The rationale for this attack construction stems from the simplicity of the attack implementation and the robust attack performance for a wide range of system parameters. We then propose a non-stationary random attack construction and show that for some systems their dynamics can be exploited by the attacker to improve upon the IID construction. 

\section{Plant Model}

We consider the plant model given by
\vspace{-3mm}
\begin{eqnarray}\label{eq1}
X_{k+1}&=&{{{\bf A}}} X_k + {{\bf B}}{{\bf V}_k}U_k +W_k, 
\end{eqnarray} 
where ${{{\bf A}}}\in \mathds{R}^{n\times n}$ is the dynamics matrix, $X_k \in \mathds{R}^n$ describes the state of the plant at time step $k\in\mathds{N}$,
${{\bf B}} \in \mathds{R}^{n \times m}$ is the 
control 
matrix, ${U}_k\in \mathds{R}^m$ is the vector of control inputs at the $k$-th time step, $W_k \in \mathds{R}^n$ is the process noise modelled by a Gaussian distributed vector of random variables with mean ${\bf 0} \in \mathds{R}^n$ and covariance matrix 
${ \Sigma_{W}} \in S^n_{++}$ where, $S^n_{++}$ is the set of $n\times n$ symmetric positive definite matrices,
and ${\bf V}_k \in S^{m}_{+}$ is the packet loss variable where the $i$-th diagonal entry is an IID Bernoulli random variable with mean $\mu_i$. We assume that the current state of the plant is determined by the vector of Gaussian distributed random variables $X_k$ with mean ${\overline{X}\in\mathds{R}^n}$ and covariance matrix ${ \Sigma_{X}} \in S^n_{++}$.


In this paper, we adopt the MPC formulation used in \cite{MPC} to describe the plant model in (\ref{eq1}) over the prediction horizon $N\in\mathds{N}_+$, resulting in the prediction model given by
\vspace{-3mm}
 \begin{eqnarray}\label{eq2}
\chi_k^{}=\Phi X_k +\Gamma {\nu }_k{\Upsilon_k} +\Lambda {\Xi_k},
\end{eqnarray} 
where $\Phi \in \mathds{R}^{Nn\times n}$ is the dynamics matrix over the prediction horizon, $\chi_k^{} \in \mathds{R}^{Nn}$ is the state prediction vector, $\Gamma \in \mathds{R}^{Nn\times Nm}$  is the propagation matrix for the control law over the prediction horizon, ${\Upsilon_k} \in \mathds{R}^{mN}$ is the realisation at the $k$-th time step of the control law, $\Lambda \in \mathds{R}^{Nn\times Nn}$ is the propagation matrix for the process noise, ${\Xi_k} \in \mathds{R}^{Nn}$ is the process noise over the prediction horizon, and $\nu _k$ is a diagonal matrix with the Bernoulli random variables describing the packet losses over the prediction horizon along the diagonal. All the terms in (\ref{eq2}) are presented in (\ref{big}).
Due to the lossy communication between the controller and the plant, the operator implements a communication protocol to monitor the state of the packets transmitted to the plant. We adopt the two protocol paradigms proposed by \cite{1}, namely a UDP-like protocol that does not monitor the channel and a TCP-like protocol that acknowledges receipt of the packet from the controller by sending an {\it acknowledgement} message to the controller over an auxiliary channel. The difference between both protocol paradigms is depicted in Fig. \ref{fig1} and Fig. \ref{fig2}, which show the UDP-like and the TCP-like protocols, respectively. The information set available to the controller is determined by the choice of the protocol. We define the information sets as
\begin{equation}
{\cal I}_k=
\begin{cases}
{\cal F}_k=\left\lbrace X^k, {\bf V}^{k-1}\right\rbrace,&\mbox{TCP-like,}\\
{\cal G}_k=\left\lbrace X^k\right\rbrace,&\mbox{UDP-like},\\
\end{cases}
\end{equation}
where ${\bf V}^{k-1}=\left\lbrace {\bf V}_0, {\bf V}_1, \ldots, {\bf V}_{k-1}\right\rbrace$, $X^{k}=\left\lbrace X_0, X_1, \ldots, X_{k}\right\rbrace$ and all sets are monotonically increasing, i.e. there is a filtration such that $\mathcal{I}_{k} \subseteq \mathcal{I}_{k+1}$. It is shown in \cite{MPC} that for both protocols the optimal control law is determined by the mean of the packet loss variable $\bar{\nu }\stackrel{\Delta}{=} \mathds{E}[\nu _k]$. Following in the steps of \cite{1}, the performance of the controller is characterised by a linear quadratic Gaussian (LQG) cost function. The description of the cost function in the MPC framework proposed in \cite{MPC} is the cost function
\vspace{-5mm}
 \begin{eqnarray}\label{eq4}
\!\!\! J^*\!\!\left({\cal I}_k\right)\triangleq \min_{\Upsilon_k}\left\{\!\mathds{E}\left[X_k^{^{\sf T}} {\bf Q} X_k + \chi_k^{^ {\sf T}} \Omega \chi_k^{} + {\Upsilon_k}^{\sf T} \nu ^{^{\sf T}}_k {\Psi} \nu _k {\Upsilon_k}\big|\mathcal{I}_k\right]\!\right\}\!\!,
\end{eqnarray} 
where $\Omega\in S_{++}^{Nn}$ is the state penalty diagonal matrix, ${\Psi}\in S_{++}^{Nm}$ is the input penalty diagonal matrix, and the diagonal matrix ${\bf Q} \in S_{++}^{n}$. The optimal control law for~(\ref{eq4}) is obtained in~\cite{MPC} for each protocol and shown to be
\vspace{-3mm}
\begin{eqnarray}
\label{eq:Upsilon}
\Upsilon_{k|\!\mathcal{I}_k}^*\!\!\!\!=\!\! \left\{\begin{array}{cc} \!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\!\! \Upsilon_{k|\mathcal{F}_k}^*\!\!=\!\!-\left(\!{\Psi} + {\Delta}^{\Gamma}\overline{\nu }\right)^{-1}{\bf F} X_k, \qquad &\!\! \mbox{TCP-like,} \\
\!\!\!\! \Upsilon_{k|\mathcal{G}_k}^*\!\!=\!\!-\left(\!{\Psi} + {\Delta}^{\Gamma}\overline{\nu } +\left(\!{\bf I} \odot {\Delta}^{\Gamma}\right)\!\!\left(\!1 -\overline{\nu }\right) \right)^{-1}\!\!{\bf F} X_k, &\!\! \mbox{UDP-like,} \end{array} \right.\!\!\!\!\!\!\!\!\!\!\! \nonumber 
\\
\end{eqnarray}
where $\odot$ is the element-wise Hadamard product. 
\begin{figure}[!t]
	\captionsetup{justification=centering,margin=2cm,width=\linewidth}
	\centering
	\includegraphics[scale=1]{Figures/UDP_Plant.pdf}
	\caption{The UDP-like protocol where the realisation of the packet loss ${\bf V}_k$ is not monitored}\label{fig1}
	%
\end{figure}
\subsection{Attack Model}
The performance of the controller is determined by the mean of the packet losses in the actuation channel. In view of this, we study the security risk posed by an attacker that governs the statistics of the packet losses on the actuation channel. In practice, this can be achieved by the attacker via DoS attacks over the communication channel. We are not concerned with the particular implementation of the DoS attacks, instead we study the packet loss attack strategy that aims to disrupt the operation of the controller. In particular, we consider the case in which the attacker constructs the attack sequence by designing a random distribution. The rationale for this stems from the fact that the operator expects the packet losses to be IID, and therefore, the attacker mimics the {\it nominal} operation of the channel. That being the case, the optimal attack construction is characterised by the probability of packet loss in the actuation channel, described by the diagonal matrix ${\bf V}^\alpha_k \in S^{m}_{++}$ where the $i$-th diagonal entry is an IID Bernoulli random variable with mean $\mu^\alpha_i$. 

\begin{figure}[!t]
	\captionsetup{justification=centering,margin=2cm,width=\linewidth}
	\centering
	\includegraphics[scale=1]{Figures/TCP_Plant.pdf}
	\caption[center]{The TCP-like protocol where the realisation of the packet loss ${\bf V}_k$ is transmitted back to the controller.}\label{fig2}
\end{figure}
\begin{figure*}[!t]
	\fontsize{10pt}{2pt}
	\begin{align}\label{big}\!\!\!
	\underset{\chi_k^{}}{\underbrace{\left(\begin{array}{c}X_{k+1} \\ X_{k+2} \\ \vdots \\ X_{k+N}
			\end{array}\right)}}\!\!\!
	= \!\!\!
	\underset{\Phi}{\underbrace{\left(\begin{array}{c}
			{{{\bf A}}} \\ {{\bf A}}^2 \\ \vdots \\ {{{\bf A}}}^N 
			\end{array}\right)}}X_k\!
	+ \!\!\!
	\underset{\Gamma}{\underbrace{\left(\begin{array}{cccc}
			{\bf B} &\bf 0 &\dots & \bf 0\\
			{{\bf A}}{{\bf B}} & {{\bf B}}& \ddots& \vdots\\
			\vdots& \ddots& \ddots& \bf 0 \\
			{{\bf A}}^{N-1}{\bf B} & \dots & {{\bf A}} {\bf B} & {\bf B}
			\end{array}\right)}}\
	\underset{\nu _k}{\underbrace{\left(\begin{array}{cccc}
			{\bf V}_k &\bf 0 &\dots & \bf 0 \\
			\bf 0 & {\bf V}_{k+1} & \ddots & \vdots \\
			\vdots & \ddots & \ddots & \bf 0 \\
			\bf 0 &\dots & \bf 0 & {\bf V}_{k+N-1}
			\end{array} \right)}}\ 
	\underset{{\Upsilon_k}}{\underbrace{\left(\begin{array}{c}
			U^n_k\\
			U^n_{k+1}\\
			\vdots\\
			U^n_{k+N-1}
			\end{array}\right)}}\!\!
	+\!\!
	\underset{\Lambda}{\underbrace{\left(\begin{array}{cccc}
			{\bf I} &\bf 0 &\dots & \bf 0\\
			{{\bf A}} & {\bf I} & \ddots& \vdots\\
			\vdots& \ddots& \ddots& \bf 0 \\
			{{\bf A}}^{N-1} & \dots & {{\bf A}} & {\bf I}
			\end{array}\right)}}\
	\underset{\Xi_k}{\underbrace{\left(\begin{array}{c}
			W_k \\
			W_{k+1}\\
			\vdots \\
			W_{k+N-1}
			\end{array}\right)}}\!\!\!\!\!\!\!\!
	\end{align}
	\hrulefill
	\vspace*{4pt}
\end{figure*}

To achieve this, the attacker has knowledge of the information set given by
\vspace{-0.3cm}
\begin{eqnarray}\label{eq5}
\mathcal{A}_k &=& \left\{{{\bf A}},{{\bf B}},\Sigma_{W},\bar{\nu}, \Omega, {\Psi}, {\cal I}_k \right\}.
\end{eqnarray} 
It is shown later that knowledge of the state of the plant is not necessary to construct the optimal attack and is only required to compute the cost induced by the attack for a particular realisation of the state variables. 
The controller operates under the assumption that the packet losses over the actuation channel are IID with a mean defined by ${\bf M}\stackrel{\Delta}{=}\mathds{E}[{\bf V}_k]$ for $k\in\mathds{N}$, with ${\bf M}\in S^m_{++}$. By changing the statistics of the actuation channel, the attacker induces a different distribution over the sequence of packet losses. To distinguish the induced case from the nominal case the induced sequence of packet losses is defined as the diagonal matrix ${\bf V}^\alpha_k$ as above. Similarly, the channel is characterised by ${\bf M}^\alpha\stackrel{\Delta}{=}\mathds{E}[{\bf V}^\alpha_k]$ for $k\in\mathds{N}$, with ${\bf M}^\alpha\in S^m_{++}$.
Note that the mean does not depend on the time step $k$, and therefore, the sequence of random variables describing the packet loss in the $i$-th position is IID.
The sequence of packet losses over the prediction horizon is described by the diagonal matrix $\nu _k^\alpha$ with the Bernoulli sequences along the diagonal and $\bar{\nu }^\alpha\triangleq \mathds{E}[\nu ^\alpha_k]$ for $k=1,2,\ldots,N$.


The objective of the attacker, in contrast to the objective of the controller, is to maximise the cost function~(\ref{eq4}). The cost function of the attacker is
\vspace{-3mm}
\begin{eqnarray}
 J_A\left({\cal A}_k\right)&\triangleq&
\min_{\Upsilon_{k|\mathcal{I}_k}^{*}}\left\{\mathds{E}\left[ X_k^{\sf T} {\bf Q} X_k+\chi_k^{\sf T} \Omega \chi_k+\Upsilon_k^{\sf T}{\nu }^{\alpha{\sf T}}_k {\Psi} {\nu }^{\alpha}_k \Upsilon_k\big|\mathcal{A}_k\right]\right\}\nonumber,
\end{eqnarray}



and the optimal attack construction is defined as 
\vspace{-3mm}
\begin{eqnarray}\label{eq6}
J^*_A\left({\cal A}_k\right)\triangleq\max_{\bar{\nu }^\alpha}\left\{J_A\left({\cal A}_k\right)\right\}.
\end{eqnarray}
Note that, the cost function of the operator in (\ref{eq4}) is nested inside (\ref{eq6}), i.e. the attacker chooses the worst case packet loss mean under the assumption that the controller operates optimally. The state estimation performed by the attacker accounts for the true statistics of the actuation channel to produce the state prediction
\vspace{-5mm}
\begin{eqnarray}\label{eq8}
\hat{\chi}_{k}^{\alpha} &\stackrel{\Delta}{=}& \mathds{E}\left[\chi_k\big|\mathcal{A}_k\right] = \Phi X_k +\Gamma \bar{\nu }^\alpha \Upsilon_k ,
\end{eqnarray}
and the state error prediction of the attack construction for the two protocols is given by
\vspace{-3mm}
\begin{subequations}
	\begin{eqnarray}
	{\bf E}_{k|\mathcal{F}_k}^\alpha &\stackrel{\Delta}{=}& \chi_k^{} - \mathds{E}\left[\chi_k^{}\big|\mathcal{F}_k, \nu ^{\alpha}_k\right] 

	= \Lambda {\Xi_k}, \label{eq9a}\\
	{\bf E}_{k|\mathcal{G}_k}^\alpha &\stackrel{\Delta}{=}& \chi_k^{} - \mathds{E}\left[\chi_k^{}\big|\mathcal{G}_k\right]

	= \Gamma\left(\nu ^\alpha_k - \bar{\nu }^\alpha\right){\Upsilon_k} + \Lambda {\Xi_k^{}},
	\label{eq9b}
	\end{eqnarray} 	
\end{subequations}
for the TCP-like protocol and the UDP-like protocol, respectively. Note that the TCP-like prediction includes the knowledge of $\nu ^{\alpha}_k$, this is the same knowledge the operator has when calculating this expectation. Specifically, the acknowledgement link removes the effect of the actuation from the estimation. Even though at time step $k$ the realisation of ${\bf V}_{k+1}$ is not known, it is known at time step $k+1$, and therefore, the operator knows that any chosen actuation law does not affect the estimation at future time steps as this contribution can be removed from the estimation. This is not possible if the acknowledgement channel is not a perfect channel.
The proof of the error trajectories is analogous to the proof in~\cite{MPC} and is omitted. 
We describe the attack induced cost by rewriting (\ref{eq6}) in terms of the state prediction and the state prediction error as in~\cite{MPC} which yields
\vspace{-3mm}
\begin{eqnarray}
J^*_A\left({\cal A}_k\right)&=&\max_{\bar{\nu }^\alpha}\left\{\min_{\Upsilon_{k|\mathcal{I}_k}^{*}}\left\{\mathds{E}\left[ \vphantom{\Big |}X_k^{\sf T} {\bf Q} X_k +  \Upsilon_k^{\sf T}{\nu }^{\alpha{\sf T}}_k {\Psi}{\nu }^{\alpha}_k\Upsilon_k  \right.\right. \right.\nonumber \\%Not strictly necessary
&& \qquad\quad\left.\left. \left.+ \left(\hat{\chi}_{k}^{\alpha}+{\bf E}_k^{\alpha} \right)^{\sf T} \Omega \left(\hat{\chi}_{k}^{\alpha}+{\bf E}_k^{\alpha} \right) {\Big|}\mathcal{A}_k\right]\right\}\right\},\nonumber \\
&& \mkern-18mu =X_k^{\sf T}\left( {\bf Q} + {\Delta}^\Phi \right) X_k + \max_{\bar{\nu }^\alpha}\left\{ \min_{\Upsilon_{k|\mathcal{I}_k}^{*}}\left\{\mathds{E}\left[ {\bf E}_k^{\alpha{\sf T}} \Omega {\bf E}_k^{\alpha} {\Big|}\mathcal{A}_k\right]\right\}\right.\nonumber \\ 
&& \left. \quad +  \Upsilon_{k|\mathcal{I}_k}^{*{\sf T}}\bar{\nu }^\alpha \left( 2{\bf F} X_k + \left({\Delta}^\Gamma \bar{\nu }^\alpha +{\Psi} \right)\Upsilon_{k|\mathcal{I}_k}^*\right) \right\},\label{eq11}
\end{eqnarray}
where ${\Delta}^{\Phi}=\Phi^{\sf T}\Omega\Phi$, ${\Delta}^{\Gamma}=\Gamma^{\sf T}\Omega\Gamma$, and ${\bf F}=\Gamma^{\sf T}\Omega\Phi$. 
\subsection{Monitoring of Packet Losses and Attack Detection}
The optimal control law for both protocols is determined by the mean of packet losses as shown in (\ref{eq:Upsilon}). In view of this, the operator monitors the average number of losses on the actuation channel to check that it agrees with the postulated statistic used to construct the control law. Given that the packet losses form a Bernoulli IID sequence, the distribution is fully characterised by the mean of packet losses ${\bf M}$. To that end, the system computes the average number of packet losses over each dimension on the channel up to time step $k\in\mathds{N}$ thus producing the estimate for dimension $i$ given by
\begin{equation}
\hat{\mu}_{i,k}=\frac1k\sum_{j=1}^k ({\bf V}_j)_{i,i}
\end{equation}
where $({\bf V}_j)_{i,i}$ describes the $i,i$-th element of ${\bf V}_j$. The resulting estimate of the mean probability of packet loss at time step $k$ is given by
\begin{equation}
\widehat{{\bf M}}_k=\textnormal{diag}(\hat{\mu}_{1,k}, \hat{\mu}_{2,k}, \ldots, \hat{\mu}_{m,k}).
\end{equation}
The system uses the estimate to check whether the actuation channel is nominal. In this setting, nominal operation entails that the estimated mean does not deviate significantly from the postulated mean used by the controller to implement the control law. Specifically, the operator determines a safe operation region shaped as a hypercube centered around ${\bf M}$ and with edge lengths determined by ${\bf L}\in S^m_+$, where the structure of the lengths is such that ${\bf L}=\textnormal{diag}(\epsilon_1,\epsilon_2, \ldots, \epsilon_m)$ to account for the different detection thresholds $\{\epsilon_i\}_{i=1}^m$ for each dimension of the actuation channel. The resulting safe operation region is given by
\begin{equation}
\label{eq:region}
{\cal C}({\bf M}, {\bf L})=\left\{\widehat{{\bf M}}_k\in \left[0,1\right]^{m\times m}:-{\bf L}\preceq\widehat{{\bf M}}_k-{\bf M}\preceq {\bf L}\right\}.\end{equation}
In this setting, an attack is declared at time step $k\in\mathds{N}$ if $\widehat{{\bf M}}_k\notin{\cal C}({\bf M}, {\bf L})$. Otherwise, normal operation of the system continues and the operator monitors the packet losses by updating its estimate $\widehat{{\bf M}}_k$ at time step $k\in\mathds{N}$. Note that the operator does not incorporate a monitoring performance metric in the cost function; instead, the packet loss monitoring procedure operates concurrent to the system operation but independently of the controller. The detection criteria chosen is optimal, the false alarm rate is determined by ${\bf L} $, if the operator decides upon a time varying ${\bf L}_k$ instead of a fixed ${\bf L}$ then instead define the ${\cal C}({\bf M}, {\bf L})$ above as the intersection of all the time varying regions. In view of this, the attack construction is concerned with two performance metrics: the cost increase induced by the attack on the performance of the controller and satisfying that the calculated average of the packet losses induced by the attack conforms to the safe region defined by (\ref{eq:region}). In the following, we discuss optimal attack construction strategies. It should be noted that the attacker has access to the variables ${\bf L}$ and ${\bf M}_k$.
\section{IID Attack Construction}

As a result of having access to different information sets, the UDP-like protocol error trajectory given in (\ref{eq9b}) depends on the mean of the control variable for the attacker, while the TCP-like protocol does not depend on the mean of the control variable, as shown in (\ref{eq9a}). For that reason, the derivation is presented separately for the each protocol.
\subsection{UDP-like Protocol}
The optimal attack strategy  for the UDP-like protocol is the solution to the optimisation problem
\vspace{-3mm}
\begin{subequations}\label{eq:UDP-opt}
\begin{eqnarray}
	&&\max_{\bar{\nu }^\alpha}\; \;J_A\left({\cal A}_k\right) \\
	&& \mbox{s.t.}\;\quad {\bf M}^\alpha \in {\cal C}\left({\bf M},{\bf L}\right).
\end{eqnarray}
\end{subequations}
Note that the maximisation aims to increase the cost incurred by the controller as a result of the packet losses induced by the attack while the constraint aims to keep the attack within the safe operation region. Additionally, the maximisation in (\ref{eq:UDP-opt}) and the minimisation of the control law in~\cite{MPC} differ in that ${\bf M}^{\alpha}\neq {\bf M}$, and therefore, the terms within $\Upsilon_{k|\mathcal{G}_k}^*$ described in (\ref{eq:Upsilon}) do not cancel. In the UDP-like setting the information set, ${\cal A}_k$, does not have access to the previous realisations of packet losses for estimation, that is, ${\cal I}_k={\cal G}_k$ in (\ref{eq5}).
Using Lemma 1 from~\cite{MPC} and (\ref{eq11}) yields the equivalent cost function given by
\vspace{-3mm}
\begin{eqnarray}
\label{eq:basic}
J^*_A\left({\cal A}_k\right)&=& X_k^{\sf T}\!\left( {\bf Q} + {\Delta}^\Phi \right) X_k+\textnormal{tr}\left({\Delta}^{\Lambda} \Sigma_{\Xi}\right) +\max_{\bar{\nu }^\alpha}\!\left\{\! \Upsilon_{k|\mathcal{G}_k}^{*{\sf T}}\bar{\nu }^\alpha\!\! \left( 2{\bf F} X_k \right.\right.\nonumber \\
&& \left.\left.+  \left({\Delta}^\Gamma \bar{\nu }^\alpha +{\Psi} +\left({\bf I}\odot {\Delta}^{\Gamma}\right)\left({\bf I}- \bar{\nu }^{\alpha}\right)\right)\Upsilon_{k|\mathcal{G}_k}^*\right)\right\},
\end{eqnarray}
where ${\Delta}^\Lambda=\Lambda^{\sf T}\Omega\Lambda$ and the maximisation is subject to ${\bf M}^\alpha \in {\cal C}\left({\bf M},{\bf L}\right)$. In the following, without loss of generality and for the sake of presentation clarity, it is assumed that all actuators for the system share a single communication channel as in~\cite{1}. This simplifies the attack construction while displaying the same properties of the general attack construction. 
That being the case, $\bar{\nu }^\alpha$ is a diagonal matrix with equal entries, and therefore, $\bar{\nu }^\alpha=\alpha{\bf I} $ where 
$\alpha \in \mathds{R}$ is the control variable of the attacker and $\alpha{\bf I} \in {\cal C}\left({\bf M},{\bf L}\right)$. Similarly, the detection region ${\cal C}\left({\bf M},{\bf L}\right)$ is described, in this case, by the interval ${\cal C}\left({\mu},\epsilon\right)$ where $\mu\in [0,1)$ is the mean of the Bernoulli random variable describing the packet losses in the scalar case and $\epsilon\in [0,1]$ denotes the detection threshold set by the operator. 
Within this setting, the attack strategy is characterised by the attack design parameter $\alpha$. In view of this, substituting $\alpha$ as the control variable in (\ref{eq:basic}) reduces the optimisation problem to 
\begin{eqnarray}
J^*_A\left({\cal A}_k\right)&=&X_k^{\sf T}\left( {\bf Q} +{\Delta}^\Phi \right)X_k + \textnormal{tr}\left(\Sigma_{\Xi}{\Delta}^{\Lambda}\right) \nonumber\\
&&\mkern-36mu\nqquad +\!\!\!\! \max_{\alpha\in{\cal C}\left({\mu},\epsilon\right)}\!\!\left\{\!\Upsilon_{k|\mathcal{G}_k}^{\sf T} \alpha\left(\alpha{\Delta}^\Gamma\!\! +\! \left(1-\alpha\right)\left({\bf I} \odot{\Delta}^\Gamma \right)\!+\! {\Psi} - 2 {\bf G}_{\mathcal{G}_k}\right)\!\!\Upsilon_{k|\mathcal{G}_k}\right\}.\nonumber
\end{eqnarray}
Note that the first two terms on the right hand side of the equation above are constants that do not depend on $\alpha$. Therefore, it is sufficient to maximise the last term. Substituting $-{\bf G}_{\mathcal{G}_k}^{-1}{\bf F} X_k$ for $\Upsilon_{k|\mathcal{G}_k}$ we write the term inside the maximisation as
\begin{eqnarray}\label{eq:f-UDP}
f\left(\alpha\right) &\triangleq& X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1} \alpha\left(\alpha{\Delta}^\Gamma + \left(1-\alpha\right)\left({\bf I} \odot{\Delta}^\Gamma \right)+ {\Psi} \qquad\qquad  \right. \nonumber \\
&&\qquad \qquad \qquad \qquad \qquad\qquad  \left. - 2 {\bf G}_{\mathcal{G}_k}\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k.
\end{eqnarray}
The function (\ref{eq:f-UDP}) is concave, convex, or linear in $\alpha$ depending on the system parameters, and therefore, the attacker has no control over the convexity of the cost function used for the attack construction. 
However, the information set available to the attacker determines the convexity of the cost function, and therefore, the attacker is able to construct the optimal attack by solving (\ref{eq:f-UDP}) for any system parameters.
In the following lemma we show that for the convex and linear systems the optimal attack construction is equivalent.
\begin{lem}\label{lem2}
	Let (\ref{eq:f-UDP}) be convex or linear in $\alpha$ over ${\cal C}\left(\mu,\epsilon\right)$. Then it's maximum is given by
	\vspace{-3mm}
	\begin{eqnarray}
	\max\{f(\alpha)\} =\max \left\{ f(\min\{{\cal C}\left(\mu,\epsilon\right)\}),f(\max\{{\cal C}\left(\mu,\epsilon\right)\})\vphantom{\Big |}\right\}.\nonumber
	\end{eqnarray}
\end{lem}
\begin{pf}
	Assume there is a maximum of (\ref{eq:f-UDP}), $f(a)$, such that $a \in \textnormal{Int}\{{\cal C}\left(\mu,\epsilon\right)\}$, we prove by contradiction that this is false, and therefore, the maximum is on the boundary of ${\cal C}\left(\mu,\epsilon\right)$. By the definition of convexity, for $\delta>0$ it holds that
	%
	\vspace{-3mm}
	\begin{eqnarray}
	f(a) &\ge& \max\{f(a +\delta),f(a -\delta)\},\\
	f(a) &\ge& t f(a +\delta) + (1-t)f(a -\delta).
	\end{eqnarray}
It follows that $f(a)$ is greater than any point of the line connecting $f(a +\delta)$ and $f(a -\delta))$ however, this breaks the convexity assumption of (\ref{eq:f-UDP}), and therefore, the maximum is on the boundary. This concludes the proof. 
\hfill \hfill$\blacksquare$
\end{pf}

When the function is concave there is a third maximising possibility, the case for which the global maximum of the function exists within the interval ${\cal C}\left(\mu,\epsilon\right)$. The following lemma describes this case. 
\begin{lem}\label{lem5}
	Let (\ref{eq:f-UDP}) be concave in $\alpha$ over ${\cal C}\left(\mu,\epsilon\right)$. Then the maximum of the function is given by
	\vspace{-3mm}
	\begin{eqnarray}
	\label{eq:concave_sol}
	\max\{f(\alpha)\} &=& \max\left\{ f(\min\{{\cal C}\left(\mu,\epsilon\right)\}),\vphantom{\Big |}\qquad\qquad\qquad\right. \nonumber \\
	 && \mkern-36mu\nqquad  \left. f(\max\{{\cal C}\left(\mu,\epsilon\right)\}), f\left({\mathds 1}_{{\cal C}\left(\mu,\epsilon\right)}\left(\alpha_{\max}\right) \alpha_{\max}\right)\vphantom{\Big |}\right\}, 
	\end{eqnarray}
	where $ {\mathds 1}_{\cal B}\left(\alpha_{\max}\right)$ is the indicator function as a function of $\alpha_{\max}$ over the set ${\cal B}$ and $\alpha_{\max} \in\mathds{R}$ is the global maximum of $f\left(\alpha\right)$.
\end{lem}
\begin{pf}
	In the concave case a global maximum exists, but is not necessarily within the interval ${\cal C}\left(\mu,\epsilon\right)$, and therefore, we restrict the domain to the safe operation region with the indicator function ${\mathds 1}_{{\cal C}\left(\mu,\epsilon\right)}\left(\alpha\right)$. The concavity of the function implies
	%
	%
	\vspace{-3mm}
	\begin{eqnarray}

	f^{\prime}(\alpha) &=& \Upsilon^{* \sf T}_{k|{\cal G}_k}\!\!\!\left(2\alpha{\Delta}^\Gamma\!\! +\! \left(1-2\alpha\right)\left({\bf I} \odot{\Delta}^\Gamma \right)\! + {\Psi}\! -\! 2 {\bf G}_{\mathcal{G}_k}\right)\!\! \Upsilon^{*}_{k|{\cal G}_k}\!,\ \quad \label{eq:firstderiv}\\
	f^{\prime\prime}(\alpha)&=& 2 \Upsilon^{* \sf T}_{k|{\cal G}_k}\left({\Delta}^\Gamma -\left({\bf I} \odot{\Delta}^\Gamma \right)\right) \Upsilon^{*}_{k|{\cal G}_k} < 0, \label{eq:secondderiv}
	\end{eqnarray}
	%
	where (\ref{eq:secondderiv}) follows from the strict concavity of (\ref{eq:f-UDP}). Setting (\ref{eq:firstderiv}) equal to zero gives
	%
	\begin{eqnarray}
	&& \Upsilon^{* \sf T}_{k|{\cal G}_k}\left(2\alpha{\Delta}^\Gamma + \left(1-2\alpha\right)\left({\bf I} \odot{\Delta}^\Gamma \right) + {\Psi} - 2 {\bf G}_{\mathcal{G}_k}\right) \Upsilon^{*}_{k|{\cal G}_k} =0,\nonumber
\end{eqnarray}
which results in
\begin{eqnarray}
\label{eq:alpha_solve}
	&&\mkern-36mu\mkern-18mu	2\alpha X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1}\left({\Delta}^\Gamma -\left({\bf I} \odot{\Delta}^\Gamma \right)\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k = \nonumber \\
	&& \qquad X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1}\left(2{\bf G}_{\mathcal{G}_k}-{\Psi} -\left({\bf I} \odot{\Delta}^\Gamma \right)\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k.
	\end{eqnarray}
It follows from the strict concavity of (\ref{eq:f-UDP}), as in (\ref{eq:secondderiv}), that 
\begin{eqnarray}
X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1}\left({\Delta}^\Gamma -\left({\bf I} \odot{\Delta}^\Gamma \right)\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k\ne0.
\end{eqnarray}
In view of this (\ref{eq:alpha_solve}) can be solved for $\alpha$ yielding
	\begin{eqnarray}
	\alpha_{\max} &=&

	\!\!{{1}\over{2}}h^{-1}_\textnormal{UDP}\!\!\left(\!X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1}\!\!\left(2{\bf G}_{\mathcal{G}_k}-{\Psi} -\left({\bf I} \odot{\Delta}^\Gamma \right)\right)\!\!{\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k\!\right),\qquad \label{eq24}
	\end{eqnarray}
where $h_\textnormal{UDP}\stackrel{\Delta}{=}\Upsilon^{* \sf T}_{k|{\cal G}_k}\left({\Delta}^\Gamma -\left({\bf I} \odot{\Delta}^\Gamma \right)\right) \Upsilon^{*}_{k|{\cal G}_k}$.
The global maximum is the solution when $\alpha_{\max} \in {\cal C}\left(\mu,\epsilon\right)$, i.e. the term $\alpha_{\max}\mathds{1}_{{\cal C}\left(\mu,\epsilon\right)}\left(\alpha_{\max}\right)$ in (\ref{eq:concave_sol}). When $\alpha_{\max}\notin{\cal C}\left(\mu,\epsilon\right)$ the solution follows as in the convex scenario by noticing that the inequality is strict and in the opposite direction. 
Therefore, if $\alpha_{\max}\notin{\cal C}\left(\mu,\epsilon\right)$ the attack construction reverts to selecting the value of~$\alpha$ on the maximising boundary. 
For a concave function this is equivalent to finding the boundary that is closest to $\alpha_{\max}$. 
Let~$a,b\in{\cal C}\left(\mu,\epsilon\right)$ and assume $f(a)>f(b)$ and that $|a-\alpha_{\max}|<|b-\alpha_{\max}| $, then 
	\begin{eqnarray}
	f(b) &<& t f(a) + (1-t)f(\alpha_{\max}).
	\end{eqnarray}
However, this line segment lies above the function which contradicts the fact that this function is concave, and therefore, the maximising $\alpha$ is on the boundary that is closest to $\alpha_{\max}$. This concludes the proof. \hfill$\blacksquare$
\end{pf}
Note that the $\alpha_{max}$ attack construction provides a globally optimal performance for the attacker from within the safe operation region. In fact, it also provides a lower probability of attack detection as it allows the attacker to operate away from the boundary. 

The following lemma highlights that an attack that minimises the cost of the operator is not achieved by setting $\alpha=1$. 
In the following we show that the optimal attack construction does not necessarily imply increasing the number of packet losses incurred by the operator. Indeed, there exist system parameters for which the optimal attack entails increasing the number of actuations. Whilst this might not be implementable in all attack scenarios, it is feasible to envision settings in which the attacker has full control of the actuation channel and can set the packet loss statistics at will. 
The following lemma captures this notion, namely, that the performance of the operator does not necessarily improve with the average number of received packets. Reiterating that the operator assumes a mean packet loss, and in doing so, creates an opportunity for the attacker to exploit the channel.
\begin{lem}\label{lem1}
For any choice of system parameters it holds that
\begin{equation}
\min_{a\in [0,1)} f(a)\leq \min\left\{f(1),f(\mu)\right\},
\end{equation}
where $f$ is defined in (\ref{eq:f-UDP}).
\end{lem}
\begin{pf}
	%
	Setting (\ref{eq:firstderiv}) equal to zero, and substituting in $\alpha = 1$ yields
	%
	\begin{eqnarray}
	f^\prime(1) =\Upsilon_{k|\mathcal{G}_k}^{*\sf T} \left(2\left(\mathbf{I}-\bar{\nu }\right){\Delta}^{\Gamma} - {\Psi} -\left(3\mathbf{I} -2\bar{\nu }\right)\left({\bf I} \odot {\Delta}^{\Gamma}\right)  \right)\Upsilon_{k|\mathcal{G}_k}^*. \nonumber 
	\end{eqnarray}	
	%
	For this to be a minimising solution it needs to hold that, ${\Psi}$ is equal to $2\left({\bf I}-\bar{\nu }\right){\Delta}^{\Gamma}-\left(3{\bf I}-2\bar{\nu }\right)\left({\bf I} \odot {\Delta}^{\Gamma}\right)$. Due to ${\Psi} $ being a diagonal matrix and the structure of ${\Delta}^\Gamma$ it is only possible for this equality to hold in a system with ${{\bf A}}={\bf 0}$ and a diagonal ${\bf B}$. In this scenario, ${\Delta}^{\Gamma}=\left({\bf I} \odot {\Delta}^{\Gamma}\right)$, this results in, ${\Psi}=-\left({\bf I} \odot {\Delta}^\Gamma\right)$. By assumption ${\Psi}\succ 0$, however, it is shown in Lemma \ref{lem4} that $\left({\bf I} \odot {\Delta}^\Gamma\right)\succ 0$ which is a contradiction, and therefore, $f^\prime(\alpha=1)\ne 0$ and thus $\alpha=1$ is not a minimising solution. Substituting $\alpha{\bf I}=\mu{\bf I} = {\bar{\nu }}$ in  (\ref{eq:firstderiv}) results in	%
	\begin{eqnarray}
	f^\prime(\alpha) &=&\Upsilon_{k|\mathcal{G}_k}^{*\sf T} \left(2\bar{\nu }{\Delta}^\Gamma + \left(\mathbf{I}-2\bar{\nu }\right)\left({\bf I} \odot{\Delta}^\Gamma \right)+ {\Psi} - 2 {\bf G}_{\mathcal{G}_k}\right)\Upsilon_{k|\mathcal{G}_k}^{*},\nonumber\\
	&=&-X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1} \left( {\Psi} +\left({\bf I} \odot {\Delta}^{\Gamma}\right)\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k .\label{eq49}
	\end{eqnarray}
	%
	This is not equal to $0$ due to ${\Psi}+\left({\bf I} \odot {\Delta}^\Gamma\right)\succ 0$. Therefore,~(\ref{eq49}) is strictly negative and not a minimising solution. This concludes the proof. \hfill$\blacksquare$
\end{pf}


\begin{thm}\label{thm1}
Let ${\cal A}_k=\left\{{{\bf A}},{{\bf B}},\Sigma_{W},\bar{\nu}, \Omega, {\Psi}, {\cal G}_k \right\}$ be the information set available to construct the attack, then the optimal mean packet loss probability for an IID attack is given by 
	\begin{eqnarray}
	\alpha^*_{\textnormal{UDP}} &=& \max\left\{f\left(\min\{{\cal C}\left(\mu,\epsilon\right)\}\right),\vphantom{\Big |}f\left(\max\{{\cal C}\left(\mu,\epsilon\right)\}\right),\nonumber \right.\\
	&&\left.\qquad\qquad\qquad\qquad\qquad  f\left({\mathds 1}_{{\cal C}\left(\mu,\epsilon\right)}\left(\alpha_{\max}\right)\alpha_{\max}\right)\vphantom{\Big |}\right\},\nonumber 
	\end{eqnarray}
where 
	\begin{eqnarray}
	f\left(a\right) &\triangleq& X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1} a\left(a{\Delta}^\Gamma + \left(1-a\right)\left({\bf I} \odot{\Delta}^\Gamma \right)+ {\Psi} \qquad\qquad  \right. \nonumber \\
	&&\qquad \qquad \qquad \qquad \qquad\qquad  \left. - 2 {\bf G}_{\mathcal{G}_k}\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k.\nonumber 
	\end{eqnarray}


\end{thm}

\begin{pf}
The result follows from the application of Lemma 1 for the convex and linear cases, Lemma 2 for the concave case, and by noticing that the set of solutions for the convex and linear cases is a subset of of the set of solutions of the concave case. This concludes the proof. \hfill$\blacksquare$
\end{pf}	
\subsection{TCP-like Protocol}
The optimal attack strategy  for the TCP-like protocol is the solution to the optimisation problem
\begin{subequations}\label{eq:TCP-opt}
	\begin{eqnarray}
	&&\max_{\bar{\nu }^\alpha}\; \;J_A\left({\cal A}_k\right), \\
	&& \mbox{s.t.}\;\quad {\bf M}^\alpha \in {\cal C}\left({\bf M},{\bf L}\right).
	\end{eqnarray}
\end{subequations}
Note that in this case the information set ${\cal A}_k$ contains the realisations of the packet losses as given in ${\cal F}_k$. For that reason, the optimisation problem differs from that in (\ref{eq:UDP-opt}) in that the cost function exhibits a different structure induced by the conditioning of the previous packet loss realisations. 
From (\ref{eq11}) and Lemma 1 in \cite{MPC} with substitution of the optimal control law under the TCP-like protocol in (\ref{eq:Upsilon}) yields
\begin{eqnarray}
&& J^*({\cal A}_k)= 
X_k^{\sf T}\left( {\bf Q} + {\Delta}^\Phi \right) X_k+\textnormal{tr}\left({\Delta}^{\Lambda} \Sigma_{\Xi}\right) \nonumber \\
&& +\max_{\bar{\nu }^\alpha}\left\{ X_k^{\sf T}{\bf F}^{\sf T} {\bf G}_{\mathcal{F}_k}^{-1}\bar{\nu }^\alpha \left( {\Delta}^\Gamma \bar{\nu }^\alpha   +{\Psi} -2{\bf G}_{\mathcal{F}_k} \right){\bf G}_{\mathcal{F}_k}^{-1}{\bf F} X_k\right\}\!, \quad\label{eq:31}
\end{eqnarray}
where the maximisation is subject to ${\bf M}^\alpha \in {\cal C}\left({\bf M},{\bf L}\right)$. As with the UDP-like protocol attack construction, it is assumed without loss of generality, that all actuators share a single communication channel~(\cite{1}). Therefore, $\bar{\nu }^\alpha=\alpha{\bf I}$. Noting that the first two terms in (\ref{eq:31}) do not depend on $\bar{\nu }^\alpha$ and that ${\bf G}_{\mathcal{F}_k}=\left({\Delta}^\Gamma\bar{\nu }+{\Psi}\right)$  as shown in (\cite{MPC}), then the term inside the maximisation can be rewritten as
\begin{eqnarray}
g\left(\alpha\right)&\triangleq& -X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{F}_k}^{-1}\alpha \left( {\Delta}^{\Gamma}\left(2\bar{\nu }-\alpha\mathbf{I} \right) + {\Psi} \right){\bf G}_{\mathcal{F}_k}^{-1}{\bf F} X_k. \label{eq:g-TCP}
\end{eqnarray}
Differentiating (\ref{eq:g-TCP}) results in
\begin{eqnarray}
g^{\prime}\left(\alpha\right) &= & -X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{F}_k}^{-1}\left( {\Delta}^{\Gamma}\left(2\bar{\nu }-2\alpha\mathbf{I} \right) + {\Psi} \right){\bf G}_{\mathcal{F}_k}^{-1}{\bf F} X_k,\label{eq32} \\
g^{\prime\prime}\left(\alpha\right) &= & 2 X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{F}_k}^{-1}{\Delta}^{\Gamma}{\bf G}_{\mathcal{F}_k}^{-1}{\bf F} X_k.\label{eq:second-deriv-TCP}
\end{eqnarray}


\begin{lem}\label{lem4}
	Let the pair $({{\bf A}},{\bf B})$ be reachable and the state penalty matrix $\Omega$ be positive definite. Then the function defined by (\ref{eq:g-TCP}) is convex in $\alpha$ over ${\cal C}\left(\mu,\epsilon\right)$ almost surely.
	%
	\end{lem}
	\begin{pf}
	It follows from (\ref{eq:second-deriv-TCP}) that if ${\Delta}^{\Gamma}\succ 0$ and $X_k\neq{\bf 0}$ then (\ref{eq:second-deriv-TCP}) is strictly greater than zero. Therefore, (\ref{eq:g-TCP}) is convex in $\alpha$ over ${\cal C}\left(\mu,\epsilon\right)$. It is shown in~\cite[p.225, 10.31(c)]{6} that when $\textnormal{rank}\left(\Gamma\right)=\max\{Nn,Nm\}$ and $\Omega$ is positive definite then ${\Delta}^\Gamma\succ 0$. Since $ ({{\bf A}},{\bf B})$ is a reachable pair then $\textnormal{rank}\left[ {\bf B}, {\bf A}{\bf B},\ldots,{\bf A}^{N-1}{\bf B}\right]=\max\{n,m\}$. Therefore, due to the triangular structure of $\Gamma$ we have that $\textnormal{rank}\left(\Gamma\right)=\max\{Nn,Nm\}$. Under these assumptions (\ref{eq:second-deriv-TCP}) is convex in $\alpha$ over ${\cal C}\left(\mu,\epsilon\right)$ when $X_k\neq0$, which holds with probability $1$.
	%

	This concludes the proof.\hfill$\blacksquare$
	\end{pf}
\begin{thm}\label{thm2}
	Consider a system operating with a TCP-like protocol.
	%
	\begin{eqnarray}
	g\left(\alpha\right)&\triangleq& -X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{F}_k}^{-1}\alpha \left( {\Delta}^{\Gamma}\left(2\bar{\nu }-\alpha{\bf I} \right) + {\Psi} \right){\bf G}_{\mathcal{F}_k}^{-1}{\bf F} X_k,\nonumber 
	\end{eqnarray}
	 %
	 Therefore, the optimal choice of $\alpha$ is
	\begin{eqnarray}
	\alpha^*_\textnormal{TCP} = \max\left\{g\left(\min\{{\cal C}\left(\mu,\epsilon\right)\}\right),g\left(\max\{{\cal C}\left(\mu,\epsilon\right)\}\right)\vphantom{\Big |}\right\}.\nonumber 
	\end{eqnarray}
\end{thm}
\begin{pf}
	Note from Lemma \ref{lem4} that $g(\alpha)$ is convex therefore, as shown in Lemma \ref{lem1}, $\alpha^{*}_{TCP}$ is known to be on the boundary. This concludes the proof.
	\end{pf}
Note that due to the convexity of (\ref{eq:g-TCP}) the solution of (\ref{eq32}) results in the minimising value of $\alpha$, which interestingly is not $\alpha{\bf I}=\bar{\nu }$, or $\alpha = 1$ but instead is given by
\begin{eqnarray}
\alpha_{\min}={{1}\over{2}}h_\textnormal{TCP}^{-1} \left(X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1}\!\!\left(2{\Delta}^\Gamma\bar{\nu } + {\Psi}\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k\right),
\end{eqnarray}
where $h_{TCP}= X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{F}_k}^{-1}{\Delta}^{\Gamma}{\bf G}_{\mathcal{F}_k}^{-1}{\bf F} X_k > 0$. When considering the TCP-like protocol without detection constraints, additional insight can be obtained by analysing the attack construction
\begin{eqnarray}
g\left(1\right)&=&X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{F}_k}^{-1} \left( {\Delta}^{\Gamma}\left({\bf I}- 2\bar{\nu }\right) - {\Psi} \right){\bf G}_{\mathcal{F}_k}^{-1}{\bf F} X_k, \ g\left(0\right)= 0.\ \ \ \ \label{eq:g1}
\end{eqnarray}
From (\ref{eq:g1}), if ${\Delta}^{\Gamma}\left({\bf I}- 2\bar{\nu }\right) \succ {\Psi} $ the maximising value of $\alpha$ is $1$ or $0$. 
The ${\Delta}^{\Gamma}\left({\bf I}- 2\bar{\nu }\right) $ term is the state penalty matrix $\Omega$ weighted by the reachability of the system and the packet loss probability. 
The terms in (\ref{eq:g1}) capture the average impact of actuation in the cost reduction with respect to the input penalty matrix ${\Psi}$. 
Therefore, the optimal attack is $1$ when the average cost increase per actuation is greater than the average penalty induced by the actuation. 
As a result, for a system with a high probability of packet loss that penalises state error more than actuation, the optimal attack strategy is to allow perfect communication, i.e. all packets are received by the plant.
Additionally, for $\bar{\nu }\succ{{1}\over{2}}{\bf I} $ the optimal attack strategy is $\bar{\nu }={\bf 0}$. That being the case, for a system with a low probability of packet losses the operator could simplify their detection criteria to a one-sided test.
\section{Cost Increase Analysis}
In this section we evaluate the cost increase induced by the optimal IID attack by comparing the expected cost when an attack is present to the expected cost when no attack is present, i.e.  $\mathds{E}\left[J^*_A({\cal A}_k)\right] - \mathds{E}\left[ J^*({\cal I}_k)\right]$. The expected cost increase of the three attack strategies are studied separately. The analysis is carried out for the case ${\cal C}\left(\mu,\epsilon\right)=[0,1)$, i.e. the extreme cases of the average attack packet drop.  
Note that there is no loss of generality as the case with detection constraints can be analysed following the same approach with the appropriate scaling. Additionally, when considering the different cases of $\alpha^*$ it should be noted that for a given set of detection parameters $\alpha^*$ is unique. Since, the detection parameters, $\mu,\epsilon$, are not fixed. The region $[0,1)$ is continuous with respect to $\alpha^*$.
\newsavebox{\smlA
\savebox{\smlA}{$\left(\begin{smallmatrix} 1.03&0.005\\0.35&0.5\end{smallmatrix}\right)$}
\newsavebox{\smlB
\savebox{\smlB}{$\left(\begin{smallmatrix}1&0\\0&1\end{smallmatrix}\right)$}
\newsavebox{\smlV
\savebox{\smlV}{$\left(\begin{smallmatrix}0.7&0\\0&0.01\end{smallmatrix}\right)$}
\subsection{UDP-like Cost Analysis}
\subsubsection{Attack performance when $\alpha^*\rightarrow0$.}

We first analyse the case when the attacker losses all the packets and induces the cost 
\begin{equation}
\mathds{E}\left[J^0_A({\cal A}_k)\right]\stackrel{\Delta}{=} \lim_{\alpha^*\rightarrow 0}\mathds{E}\left[J_A({\cal A}_k)\right].
\end{equation}
The expected cost 
when there is an attack is given by
\begin{equation}
\mathds{E}\left[J^0_A({\cal A}_k)\right]= \textnormal{tr}\left(\Sigma_{X}\left({\bf Q} + {\Delta}^\Phi\right) + \Sigma_{\Xi}{\Delta}^{\Lambda}\right)+ \max\{f(\alpha)\}.
\end{equation}
Since (\ref{eq:f-UDP}) is continuous in $\alpha$ we have that $\alpha^*\rightarrow0$ implies $f\left(\alpha^*\right)\rightarrow0$, and therefore, the cost increase is
\begin{equation}
\mathds{E}\left[J^0_A({\cal A}_k)\right]-\mathds{E}\left[J^*({\mathcal{G}_k})\right]\
= X_k^{\sf T} {\bf F}^{\sf T} {\bf G}_{\mathcal{G}_k}^{-1}\bar{\nu } {\bf F} X_k >0.\label{eq39}
\end{equation}
Note that the $\alpha^*\rightarrow0$ attack strategy forces the system into open loop, and therefore, the expected cost increase coincides with the expected cost reduction introduced by the controller when there is no attack present in the communication channel.
\subsubsection{Attack performance when $\alpha^*=1$.}
In this case, the attacker allows successful reception of all packets, i.e. the actuation communication channel is perfect. Surprisingly, there exist systems for which the cost increase, given by
\begin{equation}
\mathds{E}\left[J^1_A({\cal A}_k)\right]\stackrel{\Delta}{=} \mathds{E}\left[J_A({\cal A}_k)\right]\Big |_{\alpha^*=1},
\end{equation}
is positive despite the fact that the communication channel of the operator improves. Evaluation of (\ref{eq:f-UDP}) with perfect communication results in
 



\begin{eqnarray}
\mathds{E}\left[J^1({\cal A}_k)\right]&=& \textnormal{tr}\left(\Sigma_{X}\left({\bf Q} + {\Delta}^\Phi\right) + \Sigma_{\Xi}{\Delta}^{\Lambda}\right)\nonumber \\
&&+ X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1} \left({\bf I}-2\bar{\nu }\right)\left({\Delta}^{\Gamma} - \left({\bf I} \odot {\Delta}^{\Gamma}\right)\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k \nonumber \\
&& -X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1} \left(\left({\bf I} \odot {\Delta}^{\Gamma}\right)+ {\Psi}  \right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k.
\end{eqnarray}
Unlike the $\alpha^*\rightarrow0$ case, the $\alpha^*=1$ construction does not guarantee an increase in cost for every system. In fact, the cost only increases when
\begin{eqnarray}
&&X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1} \left({\bf I}-2\bar{\nu }\right)\left({\Delta}^{\Gamma} - \left({\bf I} \odot {\Delta}^{\Gamma}\right)\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k\ \ge \nonumber \\ 
&&\qquad\qquad X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1} \left(\left({\bf I} \odot {\Delta}^{\Gamma}\right)+ {\Psi}  \right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k> 0. \label{eq44}
\end{eqnarray}
However, all variables that determine (\ref{eq44}) are system parameters known by the attacker, and therefore, the attacker decides the optimal attack strategy accordingly. The expected cost increase is
\begin{eqnarray}
&&\mathds{E}\left[J^1_A({\cal A}_k)\right]-\mathds{E}\left[J^*({\cal G}_k)\right]\nonumber \\
&&= X_k^{\sf T} {\bf F}^{\sf T} {\bf G}_{\mathcal{G}_k}^{-1} \left({\Delta}^\Gamma + {\Psi} \right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k +\left(\bar{\nu }-2{\bf I}\right)X_k^{\sf T} {\bf F}^{\sf T} {\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k. \nonumber 
\end{eqnarray} 
\subsubsection{Attacker performance when $\alpha^* ={\mathds{1}_{{\cal C}\left(\mu,\epsilon\right)}\left(\alpha_{\max}\right)}\alpha_{\max}$.}
We tackle next the introduction of a general detection constraint.
In this case, the expected cost for the attacker is
\begin{eqnarray}
\mathds{E}\left[J^{\alpha_{\max}}({\cal A}_k)\right]&\stackrel{\Delta}{=}& \mathds{E}\left[J_A({\cal A}_k)\right]\Big |_{\alpha^*=\alpha_{\textnormal{max}}}\nonumber\\
&=&\textnormal{tr}\left(\Sigma_{X}\left({\bf Q} + {\Delta}^\Phi\right) + \Sigma_{\Xi}{\Delta}^{\Lambda}\right) + f(\alpha_{\max}).\nonumber 
\end{eqnarray}
Algebraic maniupulation of $f(\alpha_{\max})$ and substituting (\ref{eq24}) yields:
\begin{eqnarray}
 f(\alpha_{\max})\!\!= \!\!\frac{ h_\textnormal{UDP}^{-1} }{4
\left(X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1}\left(2{\bf G}_{\mathcal{G}_k}-{\Psi} -\left({\bf I} \odot{\Delta}^\Gamma \right)\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k\right)^2\!\!,\nonumber
\end{eqnarray}

where the inequality comes from the fact that $f$ is concave when $\alpha_{\textnormal{max}}$ is a feasible optimal attack strategy. The resulting cost increase is 
\begin{eqnarray}
\mathds{E}\left[J^{\alpha_{\max}}\left({\cal A}_k\right)\right] - J^*({\cal G}_k)
&=&X_k^{\sf T} {\bf F}^{\sf T} {\bf G}_{\mathcal{G}_k}^{-1}\bar{\nu } {\bf F} X_k \nonumber \\
&& \mkern-36mu\nqquad\mkern-36mu\nqquad \mkern-36mu\nqquad \ \ \ + {{1}\over{4}} h_\textnormal{UDP}^{-1}\left(X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{G}_k}^{-1}\left(2{\bf G}_{\mathcal{G}_k}-{\Psi} -\left({\bf I} \odot{\Delta}^\Gamma \right)\right){\bf G}_{\mathcal{G}_k}^{-1} {\bf F} X_k\right)^2 > 0. \nonumber
\end{eqnarray}
Note that the inequality is strict, i.e. the attack guarantees a performance loss of the operator. As mentioned previously this attack strategy is only feasible when $\alpha_{\max}\in{\cal C}\left(\mu,\epsilon\right)$ and (\ref{eq:f-UDP}) is concave. Additionally, $\mathds{E}\left[J^0\left({\cal A}_k\right)\right]-\mathds{E}\left[J^*\left({\cal G}_k\right)\right]$ is a upper bounded by the cost increase induced by the $\alpha^* ={\mathds{1}_{{\cal C}\left(\mu,\epsilon\right)}\left(\alpha_{\max}\right)}\alpha_{\max}$ strategy.

\subsection{TCP-like Cost Analysis}
The cost increase analysis for TCP-like protocols contains only two attack strategies. The analysis is again performed on the ${\cal C}\left(\mu,\epsilon\right)=[0,1)$ interval.
\subsubsection{Attacker performance when $\alpha^*\rightarrow0$.}
For the attack construction that forces the  system into open loop the expected cost is given by
\begin{eqnarray}
\hfill\mathds{E}\left[J^0\left({\cal A}_k\right)\right]&=& \textnormal{tr}\left(\Sigma_{X}\left({\bf Q} + {\Delta}^\Phi\right) + \Sigma_{\Xi}{\Delta}^{\Lambda}\right)+ \lim_{\alpha^*\rightarrow 0}g(\alpha^*). \nonumber 
\end{eqnarray}
Since (\ref{eq:g1}) is continuous in $\alpha$ we have that $\alpha^*\rightarrow0$ implies $g(\alpha^*)\rightarrow0$. Therefore, the expected cost increase is:
\begin{equation}
\mathds{E}\left[J^0\left({\cal A}_k\right)\right]-\mathds{E}\left[J^*\left({\cal F}_k\right)\right
= X_k^{\sf T} {\bf F}^{\sf T} {\bf G}_{\mathcal{F}_k}^{-1}\bar{\nu } {\bf F} X_k >0. \nonumber
\end{equation}
As with the UDP-like protocol, by implementing the $\alpha^*\rightarrow0$ attack strategy the attacker forces the system into open loop. Note that the cost increase for the TCP-like protocol and the UDP-like protocol under the $\alpha^*\rightarrow0$ strategy differ only in the ${\bf G}_{{\cal I}_k}$ designed by the controller, i.e. on the available information.
\subsubsection{Attacker performance when $\alpha^*=1$.}
In the TCP case, the attack that provides a perfect communication channel induces an expected cost given by
\begin{eqnarray}
\mathds{E}\left[J^1\left({\cal A}_k\right)\right]&=& \textnormal{tr}\left(\Sigma_{X}\left({\bf Q} + {\Delta}^\Phi\right) + \Sigma_{\Xi}{\Delta}^{\Lambda}\right)+ g(1). \nonumber
\end{eqnarray}
Therefore, it follows form (\ref{eq:g1}) that the expected cost increase induced by the $\alpha^*=1$ strategy is
\begin{eqnarray}
\mathds{E}\left[J^1\left({\cal A}_k\right)\right]-\mathds{E}\left[J^*\left({\cal F}_k\right)\right] &&\nonumber \\
&&\mkern-36mu\nqquad \mkern-36mu\nqquad \mkern-36mu =\underbrace{X_k^{\sf T} {\bf F}^{\sf T}{\bf G}_{\mathcal{F}_k}^{-1} \left( {\Delta}^{\Gamma}\left({\bf I}- 2\bar{\nu }\right) - {\Psi} \right){\bf G}_{\mathcal{F}_k}^{-1}{\bf F} X_k}
_{> 0} 
+\!\!\! \underbrace{X_k^{\sf T} {\bf F}^{\sf T} {\bf G}_{\mathcal{F}_k}^{-1}\bar{\nu } {\bf F} X_k}_{\mathds{E}\left[J^0\left({\cal A}_k\right)\right]-\mathds{E}\left[J^*\left({\cal F}_k\right)\right]}, \nonumber 
\end{eqnarray}
where the first term is strictly positive following the assumption that the $\alpha^*=1$ attack construction is optimal. Therefore, $\alpha*=1$ is strictly greater than the $\alpha^*\rightarrow0$ attack strategy only when ${\Delta}^{\Gamma}\left({\bf I}- 2\bar{\nu }\right) \succ {\Psi}$, which is the condition needed for the $\alpha^*=1$ construction to be optimal.
\section{Non-Stationary Random attacks}
Since the plant given in (\ref{eq1}) is Markovian, it seems reasonable to assume that the attacker should be able to exploit the memory of the system in the construction of the attack. In that sense, the IID attack construction does not provide sufficient flexibility to incorporate the time dependency between consecutive packet losses. Motivated by this insight, in the following we investigate the extension of random attacks to non-IID settings. Specifically, we consider the case in which the statistics of the attack are non-stationary. The resulting non-stationary attack construction extends the IID attack construction to an attack that corrupts a system with independent actuator channels. As in the IID case, the aim of the attacker is to increase the cost function while remaining in the safe operation region by adjusting the value of ${\bf M}^\alpha$. Additionally, the attack construction is no longer restricted to a constant ${\bf M}^\alpha$, i.e. ${\bf M}_k^\alpha\stackrel{\Delta}{=}\mathds{E}[{\bf V}^\alpha_k]$ for $k\in\mathds{N}$. The derivation of the non-stationary attack construction is equivalent to the IID attack construction up to (\ref{eq:basic}). The reason for the necessity of a different derivation stems from the fact that $\bar{{\nu }}^\alpha\neq\alpha{\bf I}$ since ${\bf M}^\alpha_{k}\neq{\bf M}^\alpha_{k+1}$ for $k\in\mathds{N}$.


We first consider the non-stationary attack construction for the UDP-like protocol. Notice that for the non-stationary construction maximising (\ref{eq:basic}) is equivalent to is equivalent to maximising the function
\begin{eqnarray}
&&\!\!  f\left(\bar{{\nu }}^\alpha\right) =\! \Upsilon_{\mathcal{G}_k}^{*{\sf T}}\bar{\nu }^\alpha\!\! \left( {\Delta}^\Gamma \bar{\nu }^\alpha +{\Psi} +\left({\bf I}\odot {\Delta}^{\Gamma}\right)\left({\bf I}- \bar{\nu }^{\alpha}\right)\vphantom{\bar{\nu }^\alpha}-2{\bf G}_{\mathcal{G}_k}\right)\Upsilon_{\mathcal{G}_k}^*,\nonumber\\ 
&&\!\! =\mbox{tr}\left(\!\! \bar{\nu }^\alpha\!\! \left( \left({\Delta}^\Gamma\!\!-\! \left({\bf I} \odot{\Delta}^\Gamma \right)\right)\!\!\bar{\nu }^\alpha +\left({\bf I} \odot{\Delta}^\Gamma \right) +\!\! {\Psi}\! - 2 {\bf G}_{\mathcal{G}_k}\right)\Upsilon_{\mathcal{G}_k}^{*}\Upsilon_{\mathcal{G}_k}^{* {\sf T}} \right), \nonumber 
\end{eqnarray}
where the maximisation is subject to ${{\bf M}}_k^{\alpha} \in {\cal C}\left({\bf M},{\bf L}\right)$ for $k\in\mathds{N}$.
Letting ${\Delta}^H={\Delta}^\Gamma -\left({\bf I} \odot{\Delta}^\Gamma \right)$, and substituting ${\bf G}_{\mathcal{G}_k}$ allows the optimal attack strategy for the UDP-like protocol to be posed as a quadratic optimisation problem (QP) given by
\begin{eqnarray}
&& \max_{\bar{{\nu }}^\alpha}\quad \mbox{tr}\left( \left[ \bar{\nu }^\alpha{\Delta}^H \bar{\nu }^\alpha - 
\bar{\nu }^\alpha\left(\left({\bf I} \odot{\Delta}^\Gamma \right) + {\Psi} + 2 \bar{{\nu }}{\Delta}^H \right)\right]\Upsilon_{\mathcal{G}_k}^{*}\Upsilon_{\mathcal{G}_k}^{* {\sf T}} \right), \nonumber \\
&& \mbox{s.t.}\qquad \!\!{{\bf M}}_k^{\alpha} \in {\cal C}\left({\bf M},{\bf L}\right) \qquad \textnormal{for } k\in\mathds{N}.
  \end{eqnarray}
Note that the set of IID attack strategies is a subset of the strategies generated with this formulation. Therefore, if IID is indeed the optimal attack then the proposed non-stationary attack construction coincides with the strategy presented in the previous section. If however, the cost induced by the non-stationary attack is greater than that induced by $\alpha{\bf I}$, then it follows that memory in the attack yields larger cost increases while satisfying the same detection constraints. Performing the same analysis for the TCP-like system results in an analogous QP formulation given by
\begin{eqnarray}
&& \max_{\bar{{\nu }}^\alpha}\quad \mbox{tr}\left( \left[ \bar{\nu }^\alpha{\Delta}^\Gamma \bar{\nu }^\alpha - 
\bar{\nu }^\alpha\left(2 \bar{{\nu }}{\Delta}^\Gamma + {\Psi} \right)\right]\Upsilon_{\mathcal{F}_k}^{*}\Upsilon_{\mathcal{F}_k}^{* {\sf T}} \right), \nonumber \\
&&  \mbox{s.t.}\qquad\!\! {{\bf M}}_k^{\alpha} \in {\cal C}\left({\bf M},{\bf L}\right) \qquad \textnormal{for } k\in\mathds{N}.
\end{eqnarray}
In the TCP-like scenario the terms ${\Delta}^\Gamma$, ${\Psi}$, and $\Upsilon_{\mathcal{F}_k}^{*}\Upsilon_{\mathcal{F}_k}^{* {\sf T}}$ are positive semidefinite. Both UDP-like and TCP-like QP formulations can be modified to include IID attacks on non-scalar systems provided that the additional constraint ${\bf M}^\alpha_k={\bf M}^\alpha_{k+1}$ for $k\in\mathds{N}$ is included.
\section{Numerical Results}
The comparison between the IID attack and the non-stationary attack is conducted over two communication channels for the same system. To that end, we use the same test system as in~\cite{MPC}. The first simulation is performed over a scalar communication channel with ${\bf M}=0.7$ by averaging $1000$ realisations of the state trajectories and is shown in Fig. \ref{fig3} and \ref{fig3a}.  Additionally, when under attack the UDP-like system trajectory depicted in Fig. \ref{fig3a} displays a larger change from the nominal state trajectory when compared with TCP-like trajectory depicted in  Fig. \ref{fig3}. For the second channel model, i.e. ${\bf M}=\usebox{\smlV}$, the non-stationary attack results in a larger increase from the nominal state trajectory when compared to the IID attack as shown in Fig. \ref{fig4} and  Fig. \ref{fig4a}, which are obtained by averaging $1000$ realisations of the state trajectories. As in the previous case, the results suggest that the system operating with a UDP-like protocol is more vulnerable to attacks than a system operating with a TCP-like protocol. 
The nominal terminal cost of the system with no attack present is $7.671$ for the UDP-like protocol shown in Fig. \ref{fig4a}. Interestingly, the terminal cost induced by the non-stationary attack is $18.217$ while the terminal cost induced by the IID attack is $13.26$. This suggests that UDP-like protocols are more vulnerable to non-stationary attacks than to IID attacks. However, the difference in the induced cost for the scalar channel shown in Fig. \ref{fig3a} is not as significant as that for the multiple input channel. Surprisingly, for the TCP-like case shown in Fig. \ref{fig4} the performance of the IID attack outperforms the non-stationary attack. Specifically, the terminal cost induced by the IID attack is $8.689$ whereas the terminal cost induced by the non-stationary attack is $8.525$. This small difference is due to numerical error in the simulations, indeed when the accuracy is increased the non-stationary cost converges to the IID attack cost. These results seem to suggest that there is no significant advantage in implementing non-stationary attacks in TCP-like systems. 

\begin{figure}[!t]					
	\captionsetup{justification=centering,margin=2cm,width=\linewidth}
		\includegraphics[width=0.9\linewidth]{Figures/Av_Attack_S-eps-converted-to.pdf}

	\caption{System with TCP-like protocol with $ {\bf A} =\usebox{\smlA}$, ${\bf M}=0.7$, and $\epsilon=0.1$.}\label{fig3}

\end{figure}
\begin{figure}[!t] 				
	\captionsetup{justification=centering,margin=2cm,width=\linewidth}
	\includegraphics[width=0.9\linewidth]{Figures/Av_Attack_UDP_S-eps-converted-to.pdf}
	\caption{System with UDP-like protocol with ${\bf A} =\usebox{\smlA}$, ${\bf M}=0.7$, and $\epsilon=0.1$.}\label{fig3a}

\end{figure}

\section{Conclusion and Comparison}

We have characterised the optimal IID attack construction for UDP-like and TCP-like systems with lossy actuation channels. The attacks are envisioned as DoS attacks over the actuation communication channel which results in packet losses being induced by the attacker. Under the assumption that the operator monitors the state of the channel with the average packet loss as the decision statistic, we have shown that the optimal attack strategy does not always increase the number of packet losses. In fact, we have characterised the effect of the system parameters over the solution structure and shown that  three different scenarios emerge for which the attack strategy is different. 
Interestingly, under both protocols the attacker only needs to know ${\Delta}^{\Gamma} $, ${\Psi}$, and ${\bf M}$ to decide the optimal strategy, unless the system operates with a UDP-like protocol and the function is concave, in which case all system parameters must be known. For all cases, the cost increase of the optimal IID construction has been characterised and analysed. We have also shown that the IID attack construction is not optimal by proposing an achievability scheme that constructs attacks with non-stationary statistics. It is shown numerically that the proposed non-stationary attack outperforms the IID attack in most settings although at the expense of increased computational complexity.
\begin{figure}[!t] 					
	\captionsetup{justification=centering,margin=2cm,width=\linewidth}
	\includegraphics[width=0.9\linewidth]{Figures/Av_Attack-eps-converted-to.pdf}
	\caption{System with TCP-like protocol with ${\bf A} =\usebox{\smlA}$, ${\bf M}=\usebox{\smlV}$, and ${\bf L}=0.1 {\bf I}$.}\label{fig4}
\end{figure}
\begin{figure}[!t] 				
	\captionsetup{justification=centering,margin=2cm,width=\linewidth}			
	\includegraphics[width=0.9\linewidth]{Figures/Av_Attack_UDP-eps-converted-to.pdf}
	\caption{System with UDP-like protocol with ${\bf A} =\usebox{\smlA}$, ${\bf M}=\usebox{\smlV}$, and ${\bf L}=0.1{\bf I}.$}\label{fig4a}
\end{figure}

\bibliographystyle{ifacconf}


